Page Restriction WP EUVD-2026-108076

The target site must run the miniOrange Page Restriction WordPress (WP) plugin (page-and-post-restriction) at version up to and including 1.6.0 and must actually be using it to restrict pages/posts - the flaw lets an unauthenticated visitor reach content the plugin was configured to protect. Limiting factors: impact is confined to disclosure of restricted content (no write/integrity or availability effect), and value to an attacker depends on how sensitive the restricted pages are; the exact request needed is not detailed in the available sources, and no fixed version is listed in the provided data.

Signals point to a moderate, not urgent, issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3) describes a network-reachable, low-complexity flaw requiring no privileges or user interaction, but with only a Low confidentiality impact and no integrity or availability impact - consistent with CWE-862 Missing Authorization allowing unauthorized access to content the plugin is meant to restrict. The vuln.today decision label is 'this_month' (not act_now/emergency). No EPSS score was supplied, the CVE is not in CISA KEV, and no proof-of-concept or exploit reference was provided, so exploitation status is 'no public exploit identified at time of analysis.' The single source is a Patchstack advisory. Net: a legitimate access-control weakness worth patching on a normal cycle, not a high-priority emergency; the low impact scope (confidentiality-only, Low) keeps real-world risk modest despite the unauthenticated network vector. Note the 'Authentication Bypass' tag is imprecise - the CWE-862 classification and description describe an authorization (access-control) failure rather than an authentication bypass.

An unauthenticated remote attacker requests a page or post that the Page Restriction plugin is supposed to protect and, because the authorization check is missing or improperly enforced, receives the restricted content. No exploit code or PoC was provided in the input, and the exact request/trigger is not described in the available sources. The impact is limited to disclosure of restricted content (C:L), with no modification or disruption.