The Simple Restrict plugin for WordPress suffers from an information exposure vulnerability (CWE-200) in all versions up to and including 1.2.7. The flaw arises because the plugin does not properly restrict access to sensitive content when using the WordPress core search functionality, enabling unauthenticated attackers to retrieve data from posts meant to be accessible only to higher-level roles such as administrators. The vulnerability has a CVSS 3.1 base score of 5.3, reflecting its network attack vector, low complexity, no privileges required, no user interaction, and limited confidentiality impact.

An unauthenticated attacker can access sensitive information from restricted posts that should only be visible to privileged roles. This exposure could lead to leakage of confidential data but does not allow modification or disruption of the system. There are no known exploits in the wild at this time.

No official patch or fix has been published yet for this vulnerability. Users of the Simple Restrict plugin should monitor the vendor's advisories for updates. Until a fix is available, consider disabling the plugin or restricting access to the WordPress search feature to trusted users only to reduce exposure.