Page and Post Restriction CVE-2026-118194

Exploitation requires that the target site runs the Page and Post Restriction plugin (version 1.6.1 or earlier) AND that the attacker can lure an already-logged-in user of that site to visit an attacker-controlled web page which issues credentialed cross-origin fetch requests to the site's REST API. The flaw only affects GET/HEAD REST requests where the current user is 0, and only confidentiality is impacted - attackers read responses (private/role-restricted posts and pages, the victim's /wp-json/wp/v2/users/me profile, and comments the victim can see) but cannot modify data. Limiting factors: the victim must be authenticated at the time of the visit, the attack depends on WordPress's permissive REST CORS echoing Origin with Access-Control-Allow-Credentials:true, and it hinges on the victim actually visiting the malicious page (UI:R). No attacker credentials or REST nonce are required.

This is a genuine but moderate-priority confidentiality issue, consistent with the vuln.today 'this_month' decision label rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5) aligns well with the described mechanism: network-reachable, low complexity, no attacker authentication, but requiring victim user interaction (visiting an attacker page) and yielding confidentiality impact only (no integrity or availability effect, since only GET/HEAD REST responses are exposed). No EPSS score, no KEV listing, and no SSVC exploitation-automatable/technical-impact breakdown were provided in the input, so probabilistic and automation signals cannot be weighed - the absence of KEV is NOT evidence of safety, merely of no confirmed in-the-wild use at analysis time. No public exploit identified at time of analysis; the references are the Wordfence advisory and WordPress plugin source-code (trac) links, not working exploit code. The reliance on UI:R (luring an authenticated victim) materially limits mass, opportunistic exploitation and pushes this toward targeted scenarios, which is coherent with a mid-range CVSS and a non-urgent decision label. Net: a real, verifiable authentication-bypass/data-disclosure flaw worth patching on a normal cycle, not a drop-everything event.

An attacker hosts a web page and lures a user who is currently logged in to the target WordPress site into visiting it. The page issues credentialed cross-origin fetch() requests to the target's REST API; because the plugin re-authenticates the victim from the logged_in cookie without a nonce and WordPress echoes the Origin with Access-Control-Allow-Credentials:true, the attacker's JavaScript can read the victim's private posts, pages, comments, and profile data from /wp-json/wp/v2/users/me. No public exploit identified at time of analysis, and no victim interaction beyond the single page visit is needed.