---
id: "CVE-2026-118194"
kind: "vulnerability"
aliases: ["CVE-2026-118194"]
title: "WordPress Page and Post Restriction plugin: logged-in users' private content readable by visiting sites"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "page-and-post-restriction", "self-hosted", "wordpress", "wordpress-plugin"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-30T06:16:47+00:00"
first_seen_at: "2026-10-30T06:28:39+00:00"
updated_at: "2026-10-30T06:29:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118194", "first_seen_at": "2026-10-30T06:28:39+00:00"}]
---

# WordPress Page and Post Restriction plugin: logged-in users' private content readable by visiting sites

The Page and Post Restriction plugin up to and including 1.6.1 re-authenticates visitors from their WordPress login cookie on REST API read requests without checking a nonce. A malicious page visited by a logged-in user can use that cookie to read restricted posts, pages, comments and the user's profile.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the Page and Post Restriction plugin is installed and at which version (`wp plugin list` or the Plugins screen in wp-admin)
- Confirm the installed version is `1.6.1` or lower

## Fix

- Page and Post Restriction plugin: the sources do not state a fixed version; the vulnerable range is all versions up to and including `1.6.1`

## Timeline

- 2026-10-30T06:28:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118194

## From the sources

The Page and Post Restriction plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.1 This is due to the `papr_restrict_page_post_rest_api()` function, hooked on `rest_pre_dispatch`, re-authenticating the current user from the `wordpress_logged_in` cookie via `wp_set_current_user()` for any GET or HEAD REST request where the current user is 0, without verifying a REST nonce — silently undoing the nonce-zeroing that WordPress core's `rest_cookie_check_errors()` performs on cookie-authenticated requests that lack an `X-WP-Nonce` header or `_wpnonce` parameter. Combined with WordPress's permissive REST CORS behavior — which echoes the request `Origin` and sets `Access-Control-Allow-Credentials: true` — this allows an unauthenticated attacker to read REST API GET responses as a logged-in victim, exposing role-restricted and private post/page content, victim user profile data via `/wp-json/wp/v2/users/me`, and comments the victim is authorized to see. This requires the attacker to lure a logged-in user into visiting an attacker-controlled page that issues credentialed cross-origin `fetch` requests against the target site's REST API; no nonce or further victim interaction beyond the page visit is needed.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_