CVE-2024-1083: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in wpchill Simple Restrict
The Simple Restrict plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.6 via the REST API. This makes it possible for authenticated attackers to bypass the plugin's restrictions to extract post titles and content
AI Analysis
Technical Summary
The Simple Restrict plugin for WordPress, up to and including version 1.2.6, contains a vulnerability (CVE-2024-1083) that permits authenticated users to bypass the plugin's content restrictions through the REST API. This flaw exposes sensitive information by allowing extraction of post titles and content that should be restricted. The vulnerability is categorized under CWE-200 (Exposure of Sensitive Information). The CVSS v3.1 base score is 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed.
Potential Impact
An authenticated attacker can bypass content restrictions enforced by the Simple Restrict plugin and access sensitive post titles and content via the REST API. This exposure could lead to unauthorized disclosure of information intended to be protected by the plugin. There is no indication of impact on integrity or availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting REST API access to trusted users only or disabling the REST API if not required. Monitor vendor channels for updates and apply patches promptly once available.
CVE-2024-1083: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in wpchill Simple Restrict
Description
The Simple Restrict plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.6 via the REST API. This makes it possible for authenticated attackers to bypass the plugin's restrictions to extract post titles and content
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Simple Restrict plugin for WordPress, up to and including version 1.2.6, contains a vulnerability (CVE-2024-1083) that permits authenticated users to bypass the plugin's content restrictions through the REST API. This flaw exposes sensitive information by allowing extraction of post titles and content that should be restricted. The vulnerability is categorized under CWE-200 (Exposure of Sensitive Information). The CVSS v3.1 base score is 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed.
Potential Impact
An authenticated attacker can bypass content restrictions enforced by the Simple Restrict plugin and access sensitive post titles and content via the REST API. This exposure could lead to unauthorized disclosure of information intended to be protected by the plugin. There is no indication of impact on integrity or availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting REST API access to trusted users only or disabling the REST API if not required. Monitor vendor channels for updates and apply patches promptly once available.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- Wordfence
- Date Reserved
- 2024-01-30T19:18:08.073Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 699f6d20b7ef31ef0b56e264
Added to database: 2/25/2026, 9:44:00 PM
Last enriched: 4/9/2026, 1:29:13 PM
Last updated: 4/11/2026, 7:58:40 PM
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.