Threats tagged 'ghsa-2v5p-jw26-49xc'

The Page and Post Restriction plugin for WordPress up to version 1.6.1 is vulnerable to an authentication bypass via its REST API. The vulnerability arises because the plugin re-authenticates users from the wordpress_logged_in cookie on GET or HEAD REST requests without verifying a REST nonce, bypassing WordPress core's nonce protections. This allows an attacker to read restricted REST API data as if they were a logged-in user by tricking a victim into visiting a malicious page that issues cross-origin credentialed fetch requests. The exposed data includes role-restricted and private post/page content, user profile information, and authorized comments.