Simple Restrict CVE-2026-15939

Exploitation requires a valid WordPress user account with at minimum contributor-level role on the target installation - unauthenticated or subscriber-only users cannot exploit this flaw under the current CVSS vector (PR:H as scored by NVD, though contributor access is more accurately PR:L). The target site must have the Simple Restrict plugin installed, active, and configured with content explicitly restricted through the plugin's own permission system; sites that have the plugin installed but have not configured any content restrictions are not meaningfully affected. The WordPress REST API must be accessible, which is the default configuration for WordPress 4.7 and later. Exploitation is limited to reading restricted post and page content - no write, delete, or privilege escalation capability is exposed through this path. Sites that do not permit open contributor registration, or that have disabled the REST API globally, are not exploitable.

The official CVSS 3.1 score of 2.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) is likely under-representative of real-world risk: NVD scored PR:H, but WordPress contributor accounts are low-privilege registered users - closer to PR:L in practical terms, which would yield approximately 4.3. Impact is bounded to confidentiality of restricted post/page content only (C:L); no integrity or availability impact is possible through this vector. The EPSS score of 0.13% at the 3rd percentile signals very low observed exploitation, consistent with the narrow attack surface (requires a registered account on the target site). A POC is publicly available via WPScan, but the KEV listing is absent, distinguishing theoretical exploitability from confirmed in-the-wild use. This is a real but low-priority finding for most organizations - it matters most to sites using Simple Restrict to gate premium or sensitive content from their own registered user base, where a rogue contributor could read gated content without authorization. Sites without contributor-level registrations open to untrusted users are minimally affected.

A registered contributor account on a WordPress site using Simple Restrict to gate member-only or premium content sends an authenticated REST API request - for example, GET /wp-json/wp/v2/posts/42 with valid credentials - targeting a post ID whose content was restricted via the plugin. Because the REST API route checks only for the generic WordPress 'read' capability (which all contributors possess) rather than the plugin's own permission mapping, the full post content is returned in the JSON response. A proof-of-concept demonstrating this technique is publicly available via WPScan.