Simple Restrict WordPress plugin before 1.2.9 exposes restricted post and page content through the WordPress REST API due to an authorization bypass. The plugin enforces its own permission system on the front-end but falls back to a generic WordPress capability check on REST API routes, allowing any contributor-level or higher WordPress account to read content that was explicitly restricted via the plugin's access controls. No public exploit identified at time of KEV review, though a proof-of-concept is publicly available via WPScan; the EPSS of 0.13% at the 3rd percentile confirms negligible observed exploitation activity.
WordPress
Authentication Bypass
Simple Restrict
Unknown
NVD
WPScan
VulDB
CVSS 3.1
2.7
EPSS
0.1%