Page and Post Restriction <= 1.4.1 - Unauthenticated Missing Authorization to Sensitive Information Exposure via REST API

Summary

CVE	CVE-2026-12000
State	PUBLISHED
Assigner	Wordfence
Source Priority	CVE Program / NVD first with legacy fallback
Published	2026-08-05 08:16:30 UTC
Updated	2026-08-12 21:00:37 UTC
Description	The Page and Post Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 1.4.0 via the WordPress core REST endpoints /wp-json/wp/v2/pages, /wp-json/wp/v2/pages/<id>, /wp-json/wp/v2/posts, and /wp-json/wp/v2/posts/<id>. This is due to the plugin's REST guards — papr_restrict_page_post_rest_api() and the the_posts filter registered by papr_filter_posts() — sourcing their restricted-ID list exclusively from papr_get_restricted_posts_id(), which only reads the per-page metabox options papr_allowed_redirect_for_pages and papr_allowed_redirect_for_posts and never consults the two global toggles papr_access_for_only_loggedin and papr_access_for_only_loggedin_posts that the plugin's own UI describes as 'Make all Pages Private' / 'Make all Posts Private'. This makes it possible for unauthenticated attackers to read the full rendered content of every published page and post on sites configured with the documented global toggles, bypassing the security boundary enforced on the frontend by papr_restrict_logged_in_users().

Primary CVSS: v3.1 7.5 HIGH from [email protected]

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.006620000 probability, percentile 0.484720000 (date 2026-08-13)

Problem Types: CWE-862 | CWE-862 CWE-862 Missing Authorization

Version	Source	Type	Score	Severity	Vector
3.1	[email protected]	Secondary	7.5	HIGH	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`
3.1	CNA	DECLARED	7.5	HIGH	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Source	Vendor	Product	Version	Platforms
CNA	Cyberlord92	Page And Post Restriction	affected 1.4.1 semver	Not specified

Reference	Source	Link	Tags
plugins.trac.wordpress.org/browser/page-and-post-restriction/tags/1.4.1/page-and-post-re...	[email protected]	plugins.trac.wordpress.org
plugins.trac.wordpress.org/browser/page-and-post-restriction/tags/1.4.0/page-and-post-re...	[email protected]	plugins.trac.wordpress.org
plugins.trac.wordpress.org/browser/page-and-post-restriction/tags/1.4.0/page-and-post-re...	[email protected]	plugins.trac.wordpress.org
plugins.trac.wordpress.org/browser/page-and-post-restriction/tags/1.4.0/page-restriction...	[email protected]	plugins.trac.wordpress.org
plugins.trac.wordpress.org/browser/page-and-post-restriction/tags/1.4.0/page-and-post-re...	[email protected]	plugins.trac.wordpress.org
plugins.trac.wordpress.org/browser/page-and-post-restriction/tags/1.4.1/page-and-post-re...	[email protected]	plugins.trac.wordpress.org
www.wordfence.com/threat-intel/vulnerabilities/id/f01302aa-00ef-440a-9c37-4fde6...	[email protected]	www.wordfence.com
plugins.trac.wordpress.org/browser/page-and-post-restriction/tags/1.4.1/page-restriction...	[email protected]	plugins.trac.wordpress.org
plugins.trac.wordpress.org/browser/page-and-post-restriction/tags/1.4.1/page-and-post-re...	[email protected]	plugins.trac.wordpress.org
plugins.trac.wordpress.org/changeset	[email protected]	plugins.trac.wordpress.org
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

CNA: Mitchell (en)

Source	Time	Event
CNA	2026-06-11T16:36:55.000Z	Vendor Notified
CNA	2026-08-04T18:21:36.000Z	Disclosed

There are currently no legacy QID mappings associated with this CVE.