---
id: "CVE-2026-114696"
kind: "vulnerability"
aliases: ["CVE-2026-114696"]
title: "miniOrange Page Restriction WordPress plugin: missing authorization check on access control"
severity: "medium"
cvss: 5.3
epss: 0.00187
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "wordpress", "wordpress-plugin"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-22T09:17:15+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T04:20:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114696", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114696", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# miniOrange Page Restriction WordPress plugin: missing authorization check on access control

The miniOrange Page Restriction plugin for WordPress is missing an authorization check, so access control settings can be exploited. An attacker may be able to view or change restricted pages and posts they should not reach.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Page Restriction plugin (page-and-post-restriction) in the WordPress admin plugins list or with `wp plugin get page-and-post-restriction --field=version`
- Confirm whether restricted pages are still blocked for a logged-out or low-privilege browser session

## Fix

- Update the miniOrange Page Restriction plugin (page-and-post-restriction) to a version later than `1.6.0`, or remove it if it is not needed
- unknown whether a patched version is published; check the plugin's WordPress.org page

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114696
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114696

## From the sources

Missing Authorization vulnerability in miniOrange Page Restriction WordPress (WP) page-and-post-restriction allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Restriction WordPress (WP): from n/a through 1.6.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_