CVE-2026-12000
Received Received - Intake

Sensitive Information Exposure in Page and Post Restriction WordPress Plugin

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: Wordfence

Description
The Page and Post Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 1.4.0 via the WordPress core REST endpoints /wp-json/wp/v2/pages, /wp-json/wp/v2/pages/<id>, /wp-json/wp/v2/posts, and /wp-json/wp/v2/posts/<id>. This is due to the plugin's REST guards — papr_restrict_page_post_rest_api() and the the_posts filter registered by papr_filter_posts() — sourcing their restricted-ID list exclusively from papr_get_restricted_posts_id(), which only reads the per-page metabox options papr_allowed_redirect_for_pages and papr_allowed_redirect_for_posts and never consults the two global toggles papr_access_for_only_loggedin and papr_access_for_only_loggedin_posts that the plugin's own UI describes as 'Make all Pages Private' / 'Make all Posts Private'. This makes it possible for unauthenticated attackers to read the full rendered content of every published page and post on sites configured with the documented global toggles, bypassing the security boundary enforced on the frontend by papr_restrict_logged_in_users().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-12000
EUVD
EUVD-2026-53188

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wordfence page_and_post_restriction to 1.4.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Page and Post Restriction plugin for WordPress has a flaw where sensitive information can be exposed. The plugin fails to properly restrict access to pages and posts via REST API endpoints even when global privacy settings are enabled. Attackers can read the full content of restricted pages and posts without authentication by exploiting this misconfiguration.

Detection Guidance

Check WordPress REST API endpoints for exposed content using curl commands like: curl -s http://yoursite.com/wp-json/wp/v2/pages | grep -i "rendered" or curl -s http://yoursite.com/wp-json/wp/v2/posts | grep -i "rendered". Verify if restricted pages/posts are accessible without authentication.

Impact Analysis

Unauthenticated attackers could access restricted content on your WordPress site, including private pages or posts. This could lead to unauthorized disclosure of sensitive information such as internal documents, drafts, or confidential content meant only for logged-in users.

Compliance Impact

This vulnerability may violate compliance requirements that mandate protection of sensitive data, such as GDPR or HIPAA. Unauthorized exposure of private content could result in data breaches, leading to legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Update the Page and Post Restriction plugin to the latest version if available. Temporarily disable the plugin if no update exists. Review and restrict access to /wp-json/wp/v2/ endpoints via server configuration or security plugins.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12000. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart