{"id":"CVE-2026-114696","kind":"vulnerability","aliases":["CVE-2026-114696"],"related":[],"title":"miniOrange Page Restriction WordPress plugin: missing authorization check on access control","description":"Missing Authorization vulnerability in miniOrange Page Restriction WordPress (WP) page-and-post-restriction allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Restriction WordPress (WP): from n/a through 1.6.0.","summary":"The miniOrange Page Restriction plugin for WordPress is missing an authorization check, so access control settings can be exploited. An attacker may be able to view or change restricted pages and posts they should not reach.","severity":"medium","cvss":5.3,"epss":0.00187,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the Page Restriction plugin (page-and-post-restriction) in the WordPress admin plugins list or with `wp plugin get page-and-post-restriction --field=version`\n- Confirm whether restricted pages are still blocked for a logged-out or low-privilege browser session","fix":"- Update the miniOrange Page Restriction plugin (page-and-post-restriction) to a version later than `1.6.0`, or remove it if it is not needed\n- unknown whether a patched version is published; check the plugin's WordPress.org page","status":"open","published_at":"2026-10-22T09:17:15+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:20:24+00:00","updated_at":"2026-10-25T04:20:24+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T04:20:24Z","model":"claude-haiku-5-5","output":{"fix":"- Update the miniOrange Page Restriction plugin (page-and-post-restriction) to a version later than `1.6.0`, or remove it if it is not needed\n- unknown whether a patched version is published; check the plugin's WordPress.org page","reach":"internet","title":"miniOrange Page Restriction WordPress plugin: missing authorization check on access control","impact":"medium","summary":"The miniOrange Page Restriction plugin for WordPress is missing an authorization check, so access control settings can be exploited. An attacker may be able to view or change restricted pages and posts they should not reach.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Restricted pages and posts readable or editable by unauthorized users","analyst_note":"Sources do not say which privilege level is needed or whether a fixed version exists; check the NVD entry and the WordPress.org plugin changelog.","how_to_check":"- Check the installed version of the Page Restriction plugin (page-and-post-restriction) in the WordPress admin plugins list or with `wp plugin get page-and-post-restriction --field=version`\n- Confirm whether restricted pages are still blocked for a logged-out or low-privilege browser session","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the miniOrange Page Restriction plugin version 1.6.0 or older that rely on it to restrict page and post access. Sites that do not use the plugin can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000627,"input_tokens":3362,"output_tokens":582,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114696':14A,17A '-2026':13A,16A '1.6.0':90C 'abl':46B 'access':10A,36B,77C 'affect':82C 'allow':73C 'attack':43B 'author':7A,33B,60C 'chang':50B 'check':8A,34B 'configur':76C 'control':11A,37B,78C 'cve':12A,15A 'exploit':41B,74C 'incorrect':75C 'issu':81C 'levels.this':80C 'may':44B 'miniorang':1A,24B,63C 'miss':6A,31B,59C 'n/a':88C 'packag':18B 'page':2A,25B,52B,64C,69C,83C 'page-and-post-restrict':68C 'plugin':5A,22B,27B 'post':54B,71C 'reach':58B 'restrict':3A,26B,51B,65C,72C,84C 'secur':79C 'set':38B 'view':48B 'vulner':61C 'wordpress':4A,19B,21B,29B,66C,85C 'wordpress-plugin':20B 'wp':67C,86C","nicknames":[],"mitigations":[],"who_affected":"Sites running the miniOrange Page Restriction plugin version 1.6.0 or older that rely on it to restrict page and post access. Sites that do not use the plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T09:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114696","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114696","severity":null,"published_at":"2026-10-22T09:17:15+00:00","modified_at":"2026-10-22T15:15:23+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114696","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114696","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}