Restrict Content CVE-2026-32546

Remote unauthenticated attacker exploits missing authorization checks in StellarWP Restrict Content plugin versions ≤3.2.22. No special configuration required beyond default installation. Attacker bypasses access control to modify protected content without authentication or authorization.

This vulnerability presents significant real-world risk despite missing CVSS and EPSS scores. As a missing authorization flaw (CWE-862) in a content restriction plugin, the technical impact is severe: attackers gain unauthorized access to restricted content, including potentially sensitive membership-only materials, premium courses, or paywalled resources. The attack vector is likely network-based requiring no special privileges or user interaction, making exploitation accessible to unauthenticated attackers. The plugin's widespread use in WordPress deployments amplifies exposure. While CVSS and EPSS data are unavailable, the authentication bypass tags and broken access control classification indicate high exploitability. The absence of explicit KEV or POC data does not diminish priority—authorization flaws in content management systems are consistently targeted. Organizations relying on this plugin for monetization or content protection should treat this as a critical priority requiring immediate patching.

An attacker discovers that a WordPress site uses Restrict Content to gate premium course materials behind a subscription tier. By making direct requests to protected content endpoints or manipulating URL parameters that the plugin fails to properly validate, the attacker bypasses the authorization checks and gains immediate access to restricted course videos, downloads, and membership-exclusive resources without possessing valid credentials. Given the likely network-based attack vector and low complexity of authorization bypass techniques, exploitation could be automated and scaled across multiple vulnerable installations.