The Anonymous Restricted Content plugin for WordPress suffers from an information disclosure vulnerability (CWE-200) because it does not properly restrict access to protected posts and pages via the REST API. Versions up to and including 1.6.2 are affected. An unauthenticated attacker can exploit this flaw to retrieve content that should be restricted, bypassing the intended protections. The CVSS 3.1 base score is 5.3, reflecting network attack vector, low complexity, no privileges required, no user interaction, and limited confidentiality impact.

The vulnerability allows unauthorized disclosure of protected content in WordPress sites using the affected plugin versions. Confidentiality of restricted posts/pages can be compromised by unauthenticated remote attackers. There is no impact on integrity or availability reported. No known exploits in the wild have been documented.

Patch status is not yet confirmed — no official fix or patch links are currently available. Users should monitor the vendor's advisory channels for updates and apply any forthcoming patches promptly. Until a fix is released, consider disabling the plugin or restricting REST API access through other means to prevent unauthorized content exposure.