The Restrict User Access – Ultimate Membership & Content Protection WordPress plugin contains an improper access control vulnerability (CWE-284) identified as CVE-2024-0687. This flaw allows unauthenticated remote attackers to retrieve post and page content through the plugin's API in all versions up to 2.5. The vulnerability is classified with a CVSS 3.1 base score of 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact. No known exploits are reported in the wild, and no patch or official vendor advisory is currently available.

The vulnerability permits unauthorized disclosure of content managed by the plugin via its API, potentially exposing sensitive or restricted information to unauthenticated users. There is no indication of impact on data integrity or service availability. The exposure is limited to content accessible through the plugin's API endpoints.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting or disabling the affected API endpoints or applying access control rules at the web server or application firewall level to prevent unauthenticated access. Monitor vendor channels for updates and apply patches promptly once available.