Page and Post Restriction CVE-2026-12000

Exploitation requires the Page and Post Restriction plugin version ≤ 1.4.0 to be installed and active, AND the target site must be using the plugin's global restriction toggles ('Make all Pages Private' / papr_access_for_only_loggedin, or 'Make all Posts Private' / papr_access_for_only_loggedin_posts) rather than relying solely on per-post/page metabox settings. The WordPress REST API must be publicly accessible, which is the default on all standard WordPress installations. Sites using exclusively per-post or per-page metabox-level restrictions are NOT affected by this bypass, as those code paths are correctly enforced. No authentication is required (PR:N per CVSS vector); no user interaction is required. The frontend restriction enforced by papr_restrict_logged_in_users() is bypassed entirely because it operates on HTML responses, not REST API responses.

The NVD CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) accurately reflects the attack characteristics: network-accessible, zero complexity, no authentication required, and full confidentiality impact on restricted content. The attack is automatable - a single HTTP GET to the WordPress REST API endpoint suffices, with no brute-forcing, interaction, or specialized tooling. EPSS data was not provided, limiting probability estimation; however, the low exploitation barrier suggests moderate-to-high probability if targeted. No CISA KEV listing and no disclosed POC mean exploitation is plausible but not confirmed as active. A critical nuance that modulates real-world risk: only sites configured with the global 'Make all Pages Private' or 'Make all Posts Private' toggles are affected - sites using exclusively per-post metabox restrictions are NOT exposed by this bypass. This conditional scope means the effective population at risk is a subset of the plugin's install base, making this a genuine priority for affected configurations rather than a universal High for all deployments.

An attacker identifies a WordPress site running Page and Post Restriction ≤ 1.4.0 with the 'Make all Pages Private' global toggle enabled, then issues an unauthenticated GET request to https://target.example.com/wp-json/wp/v2/pages. Because papr_get_restricted_posts_id() returns an empty or incomplete list under this configuration, the REST guard applies no restriction and returns the full rendered content of every protected page in the JSON response. No credentials, session tokens, or special tooling are required beyond a standard HTTP client.