CVE-2024-0682
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
The Page Restrict plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 2.5.5. This is due to the plugin not properly restricting access to posts via the REST API when a page has been made private. This makes it possible for unauthenticated attackers to view protected posts.
Risk Assessment
The risk includes exposure of content intended only for logged-in users, potentially compromising data confidentiality and user privacy.
Recommendation
Update the Page Restrict plugin to the latest patched version and review REST API configuration to ensure proper access controls.
Other vulnerabilities in Page Restrict
Original NVD description (English source)
The Page Restrict plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 2.5.5. This is due to the plugin not properly restricting access to posts via the REST API when a page has been made private. This makes it possible for unauthenticated attackers to view protected posts.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS