CVE-2026-12000: CWE-862 Missing Authorization in cyberlord92 Page and Post Restriction
The Page and Post Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 1.4.0 via the WordPress core REST endpoints /wp-json/wp/v2/pages, /wp-json/wp/v2/pages/<id>, /wp-json/wp/v2/posts, and /wp-json/wp/v2/posts/<id>. This is due to the plugin's REST guards — papr_restrict_page_post_rest_api() and the the_posts filter registered by papr_filter_posts() — sourcing their restricted-ID list exclusively from papr_get_restricted_posts_id(), which only reads the per-page metabox options papr_allowed_redirect_for_pages and papr_allowed_redirect_for_posts and never consults the two global toggles papr_access_for_only_loggedin and papr_access_for_only_loggedin_posts that the plugin's own UI describes as 'Make all Pages Private' / 'Make all Posts Private'. This makes it possible for unauthenticated attackers to read the full rendered content of every published page and post on sites configured with the documented global toggles, bypassing the security boundary enforced on the frontend by papr_restrict_logged_in_users().
AI Analysis
Technical Summary
CVE-2026-12000 is a missing authorization vulnerability (CWE-862) in the Page and Post Restriction WordPress plugin (up to version 1.4.0). The plugin's REST API restrictions rely solely on per-page metabox options and ignore global toggles that mark all pages or posts as private. As a result, unauthenticated attackers can access the full rendered content of all published pages and posts through the WordPress REST API endpoints (/wp-json/wp/v2/pages, /wp-json/wp/v2/posts, and their ID-specific variants), bypassing frontend security controls.
Potential Impact
An unauthenticated attacker can access sensitive content on affected WordPress sites that use the vulnerable plugin with global privacy toggles enabled. This leads to a confidentiality breach of all published pages and posts, potentially exposing sensitive or private information without requiring authentication.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling the plugin or not enabling the global privacy toggles that mark all pages or posts as private. Monitor vendor channels for updates and apply official patches once released.
CVE-2026-12000: CWE-862 Missing Authorization in cyberlord92 Page and Post Restriction
Description
The Page and Post Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 1.4.0 via the WordPress core REST endpoints /wp-json/wp/v2/pages, /wp-json/wp/v2/pages/<id>, /wp-json/wp/v2/posts, and /wp-json/wp/v2/posts/<id>. This is due to the plugin's REST guards — papr_restrict_page_post_rest_api() and the the_posts filter registered by papr_filter_posts() — sourcing their restricted-ID list exclusively from papr_get_restricted_posts_id(), which only reads the per-page metabox options papr_allowed_redirect_for_pages and papr_allowed_redirect_for_posts and never consults the two global toggles papr_access_for_only_loggedin and papr_access_for_only_loggedin_posts that the plugin's own UI describes as 'Make all Pages Private' / 'Make all Posts Private'. This makes it possible for unauthenticated attackers to read the full rendered content of every published page and post on sites configured with the documented global toggles, bypassing the security boundary enforced on the frontend by papr_restrict_logged_in_users().
CVSS v3.1
Score 7.5high
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-12000 is a missing authorization vulnerability (CWE-862) in the Page and Post Restriction WordPress plugin (up to version 1.4.0). The plugin's REST API restrictions rely solely on per-page metabox options and ignore global toggles that mark all pages or posts as private. As a result, unauthenticated attackers can access the full rendered content of all published pages and posts through the WordPress REST API endpoints (/wp-json/wp/v2/pages, /wp-json/wp/v2/posts, and their ID-specific variants), bypassing frontend security controls.
Potential Impact
An unauthenticated attacker can access sensitive content on affected WordPress sites that use the vulnerable plugin with global privacy toggles enabled. This leads to a confidentiality breach of all published pages and posts, potentially exposing sensitive or private information without requiring authentication.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling the plugin or not enabling the global privacy toggles that mark all pages or posts as private. Monitor vendor channels for updates and apply official patches once released.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-06-11T16:18:11.549Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a72e5c6bf8831d539734f02
Added to database: 08/05/2026, 07:27:02 UTC
Last enriched: 08/05/2026, 07:56:43 UTC
Last updated: 08/06/2026, 00:41:10 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.