The Simple Page Access Restriction plugin for WordPress suffers from a sensitive information exposure vulnerability (CWE-200) in all versions up to 1.0.29. The flaw arises because the plugin does not properly restrict access to content when queried via the WordPress core search functionality. As a result, unauthenticated attackers can retrieve data from posts that should be limited to logged-in users or higher roles. The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges required, no user interaction, and confidentiality impact only.

An attacker without authentication can access sensitive content from restricted posts, potentially leading to unauthorized disclosure of confidential information. There is no impact on data integrity or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling the plugin or restricting access to the WordPress search feature. Monitor official plugin sources for updates addressing this vulnerability.