CVE-2024-0682 describes an information disclosure vulnerability in the sivel Page Restrict WordPress plugin, affecting all versions up to 2.5.5. The issue arises from improper access control enforcement on private posts when accessed via the WordPress REST API. This allows unauthenticated users to view content that should be restricted. The vulnerability is categorized under CWE-693, indicating a failure in the protection mechanism. The CVSS score of 5.3 reflects a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No patch or remediation details are provided in the source data.

The vulnerability allows unauthenticated attackers to bypass access controls and view private posts protected by the Page Restrict plugin. This results in unauthorized information disclosure but does not affect integrity or availability. There are no reports of active exploitation in the wild. The impact is limited to confidentiality loss of private content managed by the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the Page Restrict plugin or restricting REST API access through other means to prevent unauthorized access to private posts.