Live › vulnerability › CVE-2026-114696
Go to dashboardThe miniOrange Page Restriction plugin for WordPress is missing an authorization check, so access control settings can be exploited. An attacker may be able to view or change restricted pages and posts they should not reach.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the miniOrange Page Restriction plugin version 1.6.0 or older that rely on it to restrict page and post access. Sites that do not use the plugin can skip it.
No product ranges from the sources yet.
wp plugin get page-and-post-restriction --field=version1.6.0, or remove it if it is not neededEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in miniOrange Page Restriction WordPress (WP) page-and-post-restriction allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Restriction WordPress (WP): from n/a through 1.6.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-114696")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.