Missing Authorization in miniOrange Page Restriction WordPress Plugin
CVE-2026-54852

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
Page Restriction WordPress (WP)
Vendor
CVE Published:
29 October 2026

What is CVE-2026-54852?

The miniOrange Page Restriction WordPress plugin is susceptible to a missing authorization issue that can result in incorrectly configured access control security levels. This vulnerability allows attackers to exploit unguarded entry points, potentially leading to unauthorized access to restricted pages or posts. It affects all versions up to and including 1.6.1, emphasizing the need for users to verify their configurations and apply necessary updates to ensure robust security.

Affected Version(s)

Page Restriction WordPress (WP) 0 <= 1.6.1

References

https://patchstack.com/database/wordpress/plugin/page-and...
vdb-entry

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

mj_404_error | Patchstack Bug Bounty Program
.