Restricted Site Access EUVD-2026-100896

Exploitation requires that the site actually have Restricted Site Access enabled and configured to restrict visibility (the plugin's 'Restrict site access to' / access-level settings) - on a site where the plugin is inactive or not restricting content there is nothing to bypass. Given AV:N/AC:L/PR:N/UI:N, no authentication, user interaction, or special network position is required once the restriction is in use; the limiting factor is purely that the restriction feature must be active, and the impact is confined to disclosure of restricted content (C:L, no write or availability effect).

This is a genuine but moderate-severity exposure, not a high-priority emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3 MEDIUM) is internally consistent: a remote, unauthenticated attacker can trivially exploit a broken access-control flaw with only a low confidentiality impact and no integrity or availability impact. The impact is correctly scoped as low because the flaw defeats the plugin's purpose - hiding/restricting site content - rather than granting code execution or data modification. No EPSS score was provided, the CVE is NOT listed in CISA KEV, and no public proof-of-concept is referenced (only the Patchstack database entry), so there is no public exploit identified at time of analysis. The 'Authentication Bypass' tag slightly overstates the issue: CWE-862 (Missing Authorization) and the description ('Incorrectly Configured Access Control Security Levels') indicate an authorization/restriction bypass that exposes content, not a login/session bypass that yields an authenticated identity - verify intent with the vendor. Overall: real and easy to trigger, but low blast radius; prioritize patching below any high/critical or KEV-listed items.

An unauthenticated attacker sends crafted HTTP requests to a WordPress site running Restricted Site Access <= 7.6.2 that is configured to restrict visibility (e.g., to logged-in users or allow-listed IPs). By exploiting the incorrectly configured access-control security level, the attacker retrieves pages, posts, feeds, or API responses that were intended to be hidden, disclosing content meant to remain private. No public exploit code is referenced, but the AV:N/AC:L/PR:N/UI:N vector means exploitation is low-effort once the gap is understood.