Pagerestrict
Monthly
Cross-Site Request Forgery in the Page Restrict WordPress plugin (versions through 2.5.5) allows unauthenticated remote attackers to trigger privileged admin-level actions by luring an authenticated site administrator to a malicious page. The plugin, which controls content access restrictions across a WordPress site, lacks CSRF token validation on its administrative endpoints, meaning any admin-authenticated browser session can be silently weaponized. No public exploit code or active exploitation has been identified at time of analysis, though the attack mechanism is a well-understood class requiring only social engineering against an admin user.
The Page Restrict plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 2.5.5. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery in the Page Restrict WordPress plugin (versions through 2.5.5) allows unauthenticated remote attackers to trigger privileged admin-level actions by luring an authenticated site administrator to a malicious page. The plugin, which controls content access restrictions across a WordPress site, lacks CSRF token validation on its administrative endpoints, meaning any admin-authenticated browser session can be silently weaponized. No public exploit code or active exploitation has been identified at time of analysis, though the attack mechanism is a well-understood class requiring only social engineering against an admin user.
The Page Restrict plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 2.5.5. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.