CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The Page Restriction WordPress (WP) – Protect WP Pages/Post plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.6 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.
Explanation of Vulnerability in Simple Terms
Page and Post Restriction versions up to 1.3.6 expose sensitive information that can be accessed over the network without authentication. An attacker can retrieve restricted content details without logging in or user interaction. The vulnerability affects the plugin's core access control logic, allowing unauthorized information disclosure.
What an attacker can do
Read restricted page and post content without logging in.
Potential impact on your site
Restricted pages and posts may be visible to unauthenticated visitors, bypassing intended access controls.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
