What is the severity of CVE-2024-0681?

CVE-2024-0681 is considered a moderate severity vulnerability due to its potential for information disclosure.

How do I fix CVE-2024-0681?

To fix CVE-2024-0681, update the Page Restriction WordPress plugin to version 1.3.5 or later.

What type of information can be disclosed by CVE-2024-0681?

CVE-2024-0681 can disclose private pages and posts via the REST API due to improper access restrictions.

Which versions of the Page Restriction WordPress plugin are affected by CVE-2024-0681?

CVE-2024-0681 affects all versions of the Page Restriction WordPress plugin up to and including 1.3.4.

What is the impact of CVE-2024-0681 on site security?

The impact of CVE-2024-0681 on site security includes unauthorized access to private content, potentially exposing sensitive information.

Vulnerability/
CVE-2024-0681

medium

5.3

CWE

693

13/3/2024

11/3/2025

CVE-2024-0681

First published: Wed Mar 13 2024(Updated: )

The Page Restriction WordPress (WP) – Protect WP Pages/Post plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 1.3.4. This is due to the plugin not properly restricting access to pages via the REST API when a page has been made private. This makes it possible for unauthenticated attackers to view protected pages. The vendor has decided that they will not implement REST API protection on posts and pages and the restrictions will only apply to the front-end of the site. The vendors solution was to add notices throughout the dashboard and recommends installing the WordPress REST API Authentication plugin for REST API coverage.

Credit: security@wordfence.com

Affected Software	Affected Version	How to fix
WordPress Protect WP Pages/Post	<=1.3.4
MiniOrange Page Restriction WordPress	<1.3.5

Remedy

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3034414%40page-and-post-restriction&new=3034414%40page-and-post-restriction&sfp_email=&sfph_mail=

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2024-0681?
CVE-2024-0681 is considered a moderate severity vulnerability due to its potential for information disclosure.
How do I fix CVE-2024-0681?
To fix CVE-2024-0681, update the Page Restriction WordPress plugin to version 1.3.5 or later.
What type of information can be disclosed by CVE-2024-0681?
CVE-2024-0681 can disclose private pages and posts via the REST API due to improper access restrictions.
Which versions of the Page Restriction WordPress plugin are affected by CVE-2024-0681?
CVE-2024-0681 affects all versions of the Page Restriction WordPress plugin up to and including 1.3.4.
What is the impact of CVE-2024-0681 on site security?
The impact of CVE-2024-0681 on site security includes unauthorized access to private content, potentially exposing sensitive information.

agent/references
agent/author
agent/description
agent/type
agent/severity
agent/weakness
agent/first-publish-date
collector/mitre-cve
source/MITRE
agent/source
agent/last-modified-date
agent/remedy
agent/softwarecombine
agent/event
agent/tags
collector/nvd-api
source/NVD
agent/software-canonical-lookup
agent/software-canonical-lookup-request
agent/guess-ai
vendor/miniorange
canonical/miniorange page restriction wordpress
vendor/wordpress
canonical/wordpress protect wp pages/post

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.