Live › vulnerability › CVE-2026-54852
The miniOrange Page Restriction plugin for WordPress has a missing authorization check in its page-and-post-restriction feature, affecting versions through 1.6.1. The sources describe it as an incorrectly configured access control issue, which suggests a visitor could get around page restrictions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 15:25 UTC. All times on this page are UTC.
Sites running the miniOrange Page Restriction WordPress plugin through version 1.6.1 that use it to restrict pages or posts. Sites that do not use this plugin are not affected. The sources do not describe the exact conditions needed to bypass the restriction.
No product ranges from the sources yet.
1.6.1 are affected.1.6.1 per the affected range; the sources do not name the exact fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in miniOrange Page Restriction WordPress (WP) page-and-post-restriction allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Restriction WordPress (WP): from n/a through 1.6.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-54852")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.