CVE-2026-118194 Details

A vulnerability allowing authentication bypass has been identified in the Page and Post Restriction plugin for WordPress, affecting all versions through 1.6.1. The issue arises because the 'papr_restrict_page_post_rest_api()' function, which is hooked to 'rest_pre_dispatch', re-authenticates users by using the 'wordpress_logged_in' cookie. This re-authentication occurs for any GET or HEAD REST request where the user is not logged in, and it does so without verifying a REST nonce. This behavior undoes the nonce validation that WordPress core's 'rest_cookie_check_errors()' function applies to cookie-authenticated requests missing an 'X-WP-Nonce' header or '_wpnonce' parameter. Additionally, WordPress's lenient REST CORS settings, which mirror the request 'Origin' and include 'Access-Control-Allow-Credentials: true', enable an unauthenticated attacker to access REST API GET responses as if they were a logged-in user. This exploitation can reveal role-restricted and private post or page content, user profile information through the '/wp-json/wp/v2/users/me' endpoint, and comments the user is permitted to view. To exploit this vulnerability, an attacker must trick a logged-in user into visiting a page they control, which then sends credentialed cross-origin fetch requests to the site's REST API. No nonce or additional interaction from the victim is required beyond the initial page visit.

Users are advised to update the Page and Post Restriction plugin to version 1.6.2 or a newer patched version.