Page and Post Restriction (<= 1.4.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/page-and-post-restriction--1.4.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 05 Aug 2026 09:15:51 +0000Sensitive Information Exposure in Page and Post Restriction WordPress Pluginhttps://feed.craftedsignal.io/briefs/2026-08-wp-papr-info-leak/Wed, 05 Aug 2026 09:15:51 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-wp-papr-info-leak/The Page and Post Restriction plugin for WordPress versions 1.4.0 and earlier fails to enforce global privacy settings on REST API endpoints, enabling unauthenticated access to restricted content.The Page and Post Restriction plugin for WordPress (versions 1.4.0 and below) contains a critical logical flaw that results in sensitive information exposure. The vulnerability exists because the plugin's REST API protection mechanisms fail to verify the global security toggles intended to make all pages and posts private. While the plugin correctly restricts access via the frontend, the REST API guards only evaluate per-page/per-post metabox configurations. Consequently, global privacy settings ('Make all Pages Private' and 'Make all Posts Private') are ignored during REST API requests to /wp-json/wp/v2/pages and /wp-json/wp/v2/posts. An unauthenticated attacker can exploit this discrepancy to bypass intended access controls and retrieve the full content of any published post or page on an affected WordPress installation. This impact is significant for organizations relying on the plugin to protect private or sensitive internal content that would otherwise be exposed through the public-facing REST API.

Impact

The vulnerability allows unauthenticated attackers to exfiltrate private post and page content, leading to unauthorized information disclosure. This bypasses the site's security policy, potentially exposing draft content, internal communications, or sensitive documentation intended only for authorized users. The scope of impact is contingent on the site administrator having enabled the 'Make all Pages Private' or 'Make all Posts Private' settings within the plugin.

Recommendation

  • Update the Page and Post Restriction plugin to a patched version beyond 1.4.0 immediately to restore REST API authorization logic.
  • Audit web server logs for high-frequency requests to /wp-json/wp/v2/posts/ and /wp-json/wp/v2/pages/ from unauthenticated or suspicious external IP addresses.
  • Consider disabling the WordPress REST API entirely if it is not required for site functionality, or implement a Web Application Firewall (WAF) rule to block unauthenticated access to these specific sensitive endpoints if remediation cannot be applied immediately.
]]>highadvisory