CVE-2024-24702

MediumCVSS 4.3

Published: 28/02/2024(UTC)Updated: 01/09/2026(UTC)Translated: 01/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

13th percentile - higher than 13% of all known CVEs

Summary

Cross-Site Request Forgery (CSRF) vulnerability in Matt Martz & Andy Stratton Page Restrict. This issue affects Page Restrict: from n/a through 2.5.5.

Risk Assessment

The risk includes the possibility of an attacker performing unauthorized actions, such as changing plugin settings, which could compromise system integrity.

Recommendation

Update the Page Restrict plugin to a patched version and implement CSRF protection mechanisms (e.g., tokens) in forms and requests.

Other vulnerabilities in Page Restrict

CVE-2024-0682Medium
The Page Restrict plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 2.5.5. This is due to the plugin not properly restricting access to posts via the REST API when a page has been made private. This makes it possible for unauthenticated attackers to view protected posts.

Original NVD description (English source)

Cross-Site Request Forgery (CSRF) vulnerability in Matt Martz & Andy Stratton Page Restrict.This issue affects Page Restrict: from n/a through 2.5.5.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS