CVE-2026-15939
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The Simple Restrict WordPress plugin before version 1.2.9 does not enforce its content-restriction permission check on the REST API the way it does on the front end. Instead, it relies on a generic capability check, allowing users with contributor-level access or above to read the content of restricted posts and pages they were never granted access to.
Risk Assessment
The organization may expose confidential content to users who should not have access, violating access control.
Recommendation
Update the Simple Restrict plugin to version 1.2.9 or later.
Original NVD description (English source)
The Simple Restrict WordPress plugin before 1.2.9 does not enforce its content-restriction permission check on the REST API the way it does on the front end, relying there on a generic capability check instead of the Simple Restrict WordPress plugin before 1.2.9's own permission system, allowing users with contributor-level access or above to read the content of restricted posts and pages they were never granted access to.