CVE-2026-118194 in Page and Post Restriction Plugin
Summary
by MITRE • 10/30/2026
The Page and Post Restriction plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.1 This is due to the `papr_restrict_page_post_rest_api()` function, hooked on `rest_pre_dispatch`, re-authenticating the current user from the `wordpress_logged_in` cookie via `wp_set_current_user()` for any GET or HEAD REST request where the current user is 0, without verifying a REST nonce — silently undoing the nonce-zeroing that WordPress core's `rest_cookie_check_errors()` performs on cookie-authenticated requests that lack an `X-WP-Nonce` header or `_wpnonce` parameter. Combined with WordPress's permissive REST CORS behavior — which echoes the request `Origin` and sets `Access-Control-Allow-Credentials: true` — this allows an unauthenticated attacker to read REST API GET responses as a logged-in victim, exposing role-restricted and private post/page content, victim user profile data via `/wp-json/wp/v2/users/me`, and comments the victim is authorized to see. This requires the attacker to lure a logged-in user into visiting an attacker-controlled page that issues credentialed cross-origin `fetch` requests against the target site's REST API; no nonce or further victim interaction beyond the page visit is needed.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in Page and Post Restriction plugin versions up to 1.6.1 represents a critical authentication bypass within WordPress environments, fundamentally undermining access control mechanisms designed to protect sensitive content. This flaw stems from improper validation logic within the papr_restrict_page_post_rest_api function, which is hooked into the rest_pre_dispatch action. The core issue arises when this function attempts to re-authenticate users based on the wordpress_logged_in cookie for GET or HEAD REST requests where the current user ID is zero. In doing so, it invokes wp_set_current_user() without verifying a valid REST nonce. This behavior directly contradicts and silently undoes the security measures implemented in WordPress core's rest_cookie_check_errors function, which explicitly sets nonces to zero for cookie-authenticated requests that lack an X-WP-Nonce header or _wpnonce parameter. By bypassing this nonce verification step, the plugin effectively allows unauthenticated actors to assume the identity of logged-in users through simple credential-based session cookies.
The operational impact of this vulnerability is severe, as it enables cross-site request forgery attacks against the WordPress REST API with full authentication context. Because the plugin fails to enforce nonces for cookie-authenticated requests, an attacker can exploit WordPress's permissive Cross-Origin Resource Sharing behavior. The server echoes the request Origin and sets Access-Control-Allow-Credentials to true, which permits credentialed cross-origin fetch requests from malicious domains. Consequently, an unauthenticated attacker can trick a logged-in victim into visiting a controlled page that issues automated REST API calls against the target site. This allows the attacker to read sensitive data as if they were the victim user, including role-restricted and private posts or pages, detailed user profile information accessible via endpoints such as /wp-json/wp/v2/users/me, and comments authorized for viewing by that specific user. The attack requires no further interaction from the victim beyond visiting the malicious page, making it highly effective in social engineering scenarios where users are lured to click links or load external content.
From a technical classification perspective, this vulnerability aligns with CWE-287 Improper Authentication and CWE-352 Cross-Site Request Forgery. The failure to validate nonces for cookie-based authentication constitutes an improper authentication mechanism that allows privilege escalation from unauthenticated to authenticated states without proper proof of intent. Furthermore, the exploitation method relies heavily on cross-origin request capabilities enabled by misconfigured CORS policies combined with automatic credential inclusion, fitting the ATT&CK technique T1534 Cross-Site Request Forgery. The ability to exfiltrate private content and user data also touches upon CWE-200 Information Exposure, as sensitive organizational or personal information is disclosed to unauthorized parties through standard API endpoints that are typically protected by authentication layers.
Mitigation strategies must address both the immediate plugin vulnerability and broader security hygiene practices. Administrators should immediately update the Page and Post Restriction plugin to version 1.6.2 or later, where this logic error has been corrected to properly enforce nonce validation for all REST API requests involving cookie-based authentication. In cases where updating is not immediately feasible, implementing a Web Application Firewall rule that blocks REST API access from untrusted origins when credentials are present can provide temporary relief. Additionally, organizations should review their CORS configurations to ensure that Access-Control-Allow-Credentials is only set to true for explicitly trusted domains rather than allowing wildcard or echoed origin responses whenever possible. Regular security audits of custom plugins and themes against WordPress coding standards are essential to prevent similar authentication bypasses in the future, ensuring that all REST API endpoints adhere strictly to nonce verification protocols regardless of the authentication method used.