CVE-2026-12000: CWE-862 Missing Authorization in cyberlord92 Page and Post Restriction
The Page and Post Restriction plugin for WordPress up to version 1.4.0 has a vulnerability that allows unauthenticated attackers to bypass intended access restrictions on pages and posts. This occurs because the plugin's REST API guards do not properly enforce global privacy toggles, enabling exposure of full content via WordPress REST endpoints. The issue results in sensitive information exposure despite frontend restrictions.
AI Analysis
Technical Summary
CVE-2026-12000 is a missing authorization vulnerability (CWE-862) in the Page and Post Restriction WordPress plugin (up to version 1.4.0). The plugin's REST API guards rely solely on per-page metabox options to determine restricted content but ignore global toggles that mark all pages or posts as private. Consequently, unauthenticated users can access the full rendered content of all published pages and posts through the WordPress core REST endpoints (/wp-json/wp/v2/pages and /posts), bypassing the intended security boundary enforced on the frontend.
Potential Impact
An unauthenticated attacker can retrieve the full content of all published pages and posts on affected WordPress sites configured with the plugin's global privacy toggles. This leads to sensitive information exposure (confidential content leakage) without requiring authentication or privileges. The integrity and availability of the site are not affected.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider disabling the plugin or not using the global privacy toggles that mark all pages or posts as private. Monitoring vendor channels for an official fix is recommended.
CVE-2026-12000: CWE-862 Missing Authorization in cyberlord92 Page and Post Restriction
Description
The Page and Post Restriction plugin for WordPress up to version 1.4.0 has a vulnerability that allows unauthenticated attackers to bypass intended access restrictions on pages and posts. This occurs because the plugin's REST API guards do not properly enforce global privacy toggles, enabling exposure of full content via WordPress REST endpoints. The issue results in sensitive information exposure despite frontend restrictions.
CVSS v3.1
Score 7.5high
Affected software
cyberlord92
Page and Post Restriction
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-12000 is a missing authorization vulnerability (CWE-862) in the Page and Post Restriction WordPress plugin (up to version 1.4.0). The plugin's REST API guards rely solely on per-page metabox options to determine restricted content but ignore global toggles that mark all pages or posts as private. Consequently, unauthenticated users can access the full rendered content of all published pages and posts through the WordPress core REST endpoints (/wp-json/wp/v2/pages and /posts), bypassing the intended security boundary enforced on the frontend.
Potential Impact
An unauthenticated attacker can retrieve the full content of all published pages and posts on affected WordPress sites configured with the plugin's global privacy toggles. This leads to sensitive information exposure (confidential content leakage) without requiring authentication or privileges. The integrity and availability of the site are not affected.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider disabling the plugin or not using the global privacy toggles that mark all pages or posts as private. Monitoring vendor channels for an official fix is recommended.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-06-11T16:18:11.549Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a72e5c6bf8831d539734f02
Added to database: 08/05/2026, 07:27:02 UTC
Last enriched: 08/12/2026, 15:43:26 UTC
Last updated: 09/18/2026, 22:01:32 UTC
Views: 53
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.