What is the CVSS score of CVE-2026-12000?

CVE-2026-12000 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.7%.

Which versions of Page and Post Restriction are affected by CVE-2026-12000?

The Page and Post Restriction WordPress plugin (versions ≤ 1.4.0) exposes all restricted page and post content to unauthenticated users via the REST API, rendering the plugin's privacy protections…

How to fix or mitigate CVE-2026-12000?

Within 24 hours: Identify all WordPress installations running Page and Post Restriction plugin ≤ 1.4.0; immediately disable the plugin or implement emergency REST API access controls by blocking /wp-json/wp/v2/pages and /wp-json/wp/v2/posts endpoints at the web server level to prevent content exposure while investigating. Within 7 days: Review web server and WordPress access logs for unauthorized REST API endpoint access; document all content pages/posts flagged as private or restricted via the plugin's global toggles to establish scope of exposure. Within 30 days: Monitor the plugin repository for a security patch release; upon availability, thoroughly test the patched version in a staging environment, then deploy to all production installations, re-enabling the plugin only after patch verification or transition to an alternative privacy-control solution if the developer does not release a fix.

Page and Post Restriction CVE-2026-12000

EUVD-2026-53188 HIGH

Missing Authorization (CWE-862)

2026-08-05 Wordfence

GHSA-j2cm-38v7-pfcv

WordPress Authentication Bypass Information Disclosure Wordpress Plugin Page And Post Restriction Cyberlord92

7.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

REST endpoints are network-accessible with no authentication; restricted content is fully exposed; no integrity or availability impact applies.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 07:51 vuln.today

CVE Published

Aug 05, 2026 - 06:38 cve.org

HIGH 7.5

DescriptionCVE.org

The Page and Post Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 1.4.0 via the WordPress core REST endpoints /wp-json/wp/v2/pages, /wp-json/wp/v2/pages/<id>, /wp-json/wp/v2/posts, and /wp-json/wp/v2/posts/<id>. This is due to the plugin's REST guards - papr_restrict_page_post_rest_api() and the the_posts filter registered by papr_filter_posts() - sourcing their restricted-ID list exclusively from papr_get_restricted_posts_id(), which only reads the per-page metabox options papr_allowed_redirect_for_pages and papr_allowed_redirect_for_posts and never consults the two global toggles papr_access_for_only_loggedin and papr_access_for_only_loggedin_posts that the plugin's own UI describes as 'Make all Pages Private' / 'Make all Posts Private'. This makes it possible for unauthenticated attackers to read the full rendered content of every published page and post on sites configured with the documented global toggles, bypassing the security boundary enforced on the frontend by papr_restrict_logged_in_users().

AnalysisAI

Sensitive information exposure in the Page and Post Restriction WordPress plugin (versions ≤ 1.4.0) allows unauthenticated attackers to read the full rendered content of every published page and post on sites relying on the plugin's global privacy toggles. The plugin's REST API guards - papr_restrict_page_post_rest_api() and the the_posts filter in papr_filter_posts() - consult only per-post/page metabox settings and completely ignore the 'Make all Pages Private' and 'Make all Posts Private' global options, leaving the /wp-json/wp/v2/pages and /wp-json/wp/v2/posts endpoints unguarded. No public exploit is identified at time of analysis, but the attack is trivially executable with a single unauthenticated HTTP GET request.

Technical ContextAI

The Page and Post Restriction plugin (CPE: cpe:2.3:a:cyberlord92:page_and_post_restriction:*:*:*:*:*:*:*:*) provides two distinct restriction mechanisms: per-post/page metabox settings (stored in papr_allowed_redirect_for_pages and papr_allowed_redirect_for_posts) and site-wide global toggles (papr_access_for_only_loggedin and papr_access_for_only_loggedin_posts). The internal helper papr_get_restricted_posts_id() - called by both the REST API guard registered on rest_pre_dispatch and the the_posts filter - only reads the metabox options, never the global toggle options. This creates an authorization decision that is correct for per-post restrictions but structurally incomplete for global restrictions, matching CWE-862 (Missing Authorization): a check exists but fails to consult all relevant access-control state. WordPress's REST API, enabled by default, exposes full post content including rendered blocks and meta to unauthenticated callers when no effective guard intercepts the request.

RemediationAI

Upgrade the Page and Post Restriction plugin to version 1.4.2 or later; the fix is confirmed present in the 1.4.1 plugin repository tag (https://plugins.trac.wordpress.org/browser/page-and-post-restriction/tags/1.4.1/page-and-post-restriction.php#L69) with a subsequent release at 1.4.2 per the trac changeset. For sites unable to update immediately, the most targeted workaround is to migrate from the global 'Make all Pages Private' / 'Make all Posts Private' toggles to per-post/page metabox restrictions, which the guard code does correctly enforce - though this is operationally burdensome on large sites and does not replicate global behavior precisely. As an alternative compensating control, restrict access to /wp-json/wp/v2/pages and /wp-json/wp/v2/posts at the web server or WAF layer to authenticated sessions only; note that this may break REST-dependent themes, mobile apps, or third-party integrations that legitimately require public API access. Wordfence advisory: https://www.wordfence.com/threat-intel/vulnerabilities/id/f01302aa-00ef-440a-9c37-4fde6bb4bb4d.