Restrict User Access
Monthly
Route normalization bypass in the Restrict User Access WordPress plugin (all versions before 2.8.1) lets unauthenticated remote attackers read content the plugin is configured to restrict and enumerate WordPress user accounts. The plugin compares raw incoming REST API route strings against its protection rules without first canonicalizing the path, so a subtly non-canonical request (extra slash, encoded character, etc.) matches no rule and is passed through unrestricted. A publicly available PoC is documented by WPScan; the vulnerability is not in CISA KEV at time of analysis.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joachim Jensen Restrict User Access - Membership Plugin with Force restrict-user-access.5. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Restrict User Access - Ultimate Membership & Content Protection plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.5 via API. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Route normalization bypass in the Restrict User Access WordPress plugin (all versions before 2.8.1) lets unauthenticated remote attackers read content the plugin is configured to restrict and enumerate WordPress user accounts. The plugin compares raw incoming REST API route strings against its protection rules without first canonicalizing the path, so a subtly non-canonical request (extra slash, encoded character, etc.) matches no rule and is passed through unrestricted. A publicly available PoC is documented by WPScan; the vulnerability is not in CISA KEV at time of analysis.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joachim Jensen Restrict User Access - Membership Plugin with Force restrict-user-access.5. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Restrict User Access - Ultimate Membership & Content Protection plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.5 via API. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.