EUVD-2026-51937
GHSA-4v4h-6mhp-rwxf
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
WordPress contributor is a low-privilege registered role mapping to PR:L, not PR:H; only restricted post content is disclosed, yielding C:L with no integrity or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Simple Restrict WordPress plugin before 1.2.9 does not enforce its content-restriction permission check on the REST API the way it does on the front end, relying there on a generic capability check instead of the Simple Restrict WordPress plugin before 1.2.9's own permission system, allowing users with contributor-level access or above to read the content of restricted posts and pages they were never granted access to.
AnalysisAI
Simple Restrict WordPress plugin before 1.2.9 exposes restricted post and page content through the WordPress REST API due to an authorization bypass. The plugin enforces its own permission system on the front-end but falls back to a generic WordPress capability check on REST API routes, allowing any contributor-level or higher WordPress account to read content that was explicitly restricted via the plugin's access controls. No public exploit identified at time of KEV review, though a proof-of-concept is publicly available via WPScan; the EPSS of 0.13% at the 3rd percentile confirms negligible observed exploitation activity.
Technical ContextAI
Simple Restrict is a WordPress plugin that implements custom content gating, restricting access to posts and pages based on its own role/user permission mapping rather than native WordPress capabilities. WordPress serves content through two primary paths: traditional PHP front-end rendering and the REST API (enabled by default since WordPress 4.7). This plugin correctly interposes its authorization checks on front-end requests but fails to register equivalent checks on REST API routes, instead inheriting only the generic WordPress capability check (e.g., the 'read' capability possessed by all registered users including contributors). The root cause is CWE-863 (Incorrect Authorization): authorization logic exists but applies the wrong permission gate for the REST API context, creating a bypass via an alternative delivery path. The affected CPE is cpe:2.3:a:unknown:simple_restrict:*:*:*:*:*:*:*:* across all versions before 1.2.9.
RemediationAI
Update the Simple Restrict WordPress plugin to version 1.2.9 or later, which is confirmed as the patched release per the vendor advisory referenced via WPScan at https://wpscan.com/vulnerability/307a3033-ca65-4c3a-9a08-dd4a6f7dacea/. WordPress site administrators can apply this update through the standard plugin update mechanism in wp-admin. Where immediate patching is not feasible, a targeted compensating control is to restrict REST API access for low-privilege authenticated users by filtering the 'rest_authentication_errors' hook or deploying a dedicated plugin such as 'Disable REST API' - note this can break the Gutenberg block editor and any REST-dependent theme or plugin functionality, so test before applying in production. An additional interim measure is to audit and suspend contributor-level accounts that should not have access to any restricted content, reducing the pool of potential abusers until the patch is applied.
More in Simple Restrict
View allSame weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today