Page Restriction WordPress EUVD-2026-112887

Exploitation requires that the target WordPress site actually uses the miniOrange Page Restriction (page-and-post-restriction) plugin at version 1.6.1 or earlier to restrict access to specific pages or posts; the flaw lets a request reach that restricted content without the authorization the plugin is supposed to enforce (described as incorrectly configured access-control security levels). No authentication and no user interaction are required (PR:N/UI:N). The practical limiting factor is scope of impact rather than access: only content the operator chose to protect with this plugin is exposed, and the impact is read-only confidentiality (C:L) with no integrity or availability effect, so sites not using the plugin's restriction feature are unaffected.

This is a moderate-severity, low-priority issue rather than an urgent one. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3) indicates remote, unauthenticated, low-complexity exploitation with no user interaction, but the impact is confined to a limited confidentiality breach (C:L) with no integrity or availability impact - consistent with CWE-862 Missing Authorization allowing access to content that the Page Restriction plugin was meant to protect. The vuln.today decision label is 'this_month', a routine-remediation tier, not act_now or emergency. There is no CISA KEV listing and no EPSS score in the supplied data, so exploitation probability cannot be quantified from the input; absence of these signals is not evidence of safety but it does not elevate priority either. No public exploit is identified in the input - the only reference is the Patchstack advisory entry, which is a vulnerability database record, not verified exploit code. The signals are internally consistent (low-impact information-disclosure flaw, routine priority), so the main caveat is simply the missing EPSS/KEV data and the lack of a vendor-confirmed fixed version.

A remote attacker targets a WordPress site using the miniOrange Page Restriction plugin (≤1.6.1) to gate pages or posts. Because authorization is not enforced on the protected resource, the attacker requests the restricted URL directly and receives the content that should have required authorized access, without supplying any credentials. No public proof-of-concept exploit code is identified in the available data.