{"id":"CVE-2026-54852","kind":"vulnerability","aliases":["CVE-2026-54852"],"related":[],"title":"miniOrange Page Restriction WordPress plugin: missing authorization check through 1.6.1","description":"Missing Authorization vulnerability in miniOrange Page Restriction WordPress (WP) page-and-post-restriction allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Restriction WordPress (WP): from n/a through 1.6.1.","summary":"The miniOrange Page Restriction plugin for WordPress has a missing authorization check in its page-and-post-restriction feature, affecting versions through 1.6.1. The sources describe it as an incorrectly configured access control issue, which suggests a visitor could get around page restrictions.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["miniorange","package","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the miniOrange Page Restriction plugin in the WordPress admin under Plugins; the sources say versions through `1.6.1` are affected.","fix":"- Versions after `1.6.1` per the affected range; the sources do not name the exact fixed version.","status":"open","published_at":"2026-10-29T15:17:23+00:00","first_seen_at":"2026-10-29T15:25:40+00:00","triaged_at":"2026-10-29T15:26:51+00:00","updated_at":"2026-10-29T15:26:51+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-29T15:26:51Z","model":"claude-haiku-5-5","output":{"fix":"- Versions after `1.6.1` per the affected range; the sources do not name the exact fixed version.","reach":"internet","title":"miniOrange Page Restriction WordPress plugin: missing authorization check through 1.6.1","impact":"medium","summary":"The miniOrange Page Restriction plugin for WordPress has a missing authorization check in its page-and-post-restriction feature, affecting versions through 1.6.1. The sources describe it as an incorrectly configured access control issue, which suggests a visitor could get around page restrictions.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","miniorange"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"visitors read restricted pages or posts without permission","analyst_note":"Confirm the exact fixed version and the vulnerable endpoint from the NVD entry or the vendor's plugin changelog.","how_to_check":"- Check the installed version of the miniOrange Page Restriction plugin in the WordPress admin under Plugins; the sources say versions through `1.6.1` are affected.\n- unknown for any further check: the sources do not describe the exact request or endpoint.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the miniOrange Page Restriction WordPress plugin through version 1.6.1 that use it to restrict pages or posts. Sites that do not use this plugin are not affected. The sources do not describe the exact conditions needed to bypass the restriction.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000712,"input_tokens":4130,"output_tokens":597,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-54852':13A,16A '1.6.1':10A,46B,98C 'access':55B,85C 'affect':43B,90C 'allow':81C 'around':64B 'author':7A,33B,68C 'check':8A,34B 'configur':54B,84C 'control':56B,86C 'could':62B 'cve':11A,14A 'describ':49B 'exploit':82C 'featur':42B 'get':63B 'incorrect':53B,83C 'issu':57B,89C 'levels.this':88C 'miniorang':1A,17B,24B,71C 'miss':6A,32B,67C 'n/a':96C 'packag':18B 'page':2A,25B,38B,65B,72C,77C,91C 'page-and-post-restrict':37B,76C 'plugin':5A,22B,27B 'post':40B,79C 'restrict':3A,26B,41B,66B,73C,80C,92C 'secur':87C 'sourc':48B 'suggest':59B 'version':44B 'visitor':61B 'vulner':69C 'wordpress':4A,19B,21B,29B,74C,93C 'wordpress-plugin':20B 'wp':75C,94C","nicknames":[],"mitigations":[],"who_affected":"Sites running the miniOrange Page Restriction WordPress plugin through version 1.6.1 that use it to restrict pages or posts. Sites that do not use this plugin are not affected. The sources do not describe the exact conditions needed to bypass the restriction.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T15:17:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-54852","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54852","severity":null,"published_at":"2026-10-29T15:17:23+00:00","modified_at":"2026-10-29T15:18:54+00:00","first_seen_at":"2026-10-29T15:25:40+00:00","fetched_at":"2026-10-29T15:25:40+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}