Content Control
Monthly
Unauthenticated broken access control in the Content Control WordPress plugin (versions ≤ 2.6.5) allows remote attackers to bypass content restriction rules and retrieve content intended to be hidden from public or lower-privileged users. The plugin, which provides role-based content gating for WordPress sites, fails to enforce authorization in at least one code path, permitting network access without credentials or user interaction per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector. No public exploit code or CISA KEV listing has been identified at time of analysis, and impact is bounded to partial confidentiality loss with no integrity or availability effects.
Unauthenticated broken access control in the Content Control WordPress plugin (versions ≤ 2.6.5) allows remote attackers to bypass content restriction rules and retrieve content intended to be hidden from public or lower-privileged users. The plugin, which provides role-based content gating for WordPress sites, fails to enforce authorization in at least one code path, permitting network access without credentials or user interaction per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector. No public exploit code or CISA KEV listing has been identified at time of analysis, and impact is bounded to partial confidentiality loss with no integrity or availability effects.