Simple Restrict
Monthly
Simple Restrict WordPress plugin before 1.2.9 exposes restricted post and page content through the WordPress REST API due to an authorization bypass. The plugin enforces its own permission system on the front-end but falls back to a generic WordPress capability check on REST API routes, allowing any contributor-level or higher WordPress account to read content that was explicitly restricted via the plugin's access controls. No public exploit identified at time of KEV review, though a proof-of-concept is publicly available via WPScan; the EPSS of 0.13% at the 3rd percentile confirms negligible observed exploitation activity.
The Simple Restrict plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.6 via the REST API. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Simple Restrict WordPress plugin before 1.2.9 exposes restricted post and page content through the WordPress REST API due to an authorization bypass. The plugin enforces its own permission system on the front-end but falls back to a generic WordPress capability check on REST API routes, allowing any contributor-level or higher WordPress account to read content that was explicitly restricted via the plugin's access controls. No public exploit identified at time of KEV review, though a proof-of-concept is publicly available via WPScan; the EPSS of 0.13% at the 3rd percentile confirms negligible observed exploitation activity.
The Simple Restrict plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.6 via the REST API. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.