CVE-2024-0681: Page Restriction WordPress (WP) – Protect WP Pages/Post <= 1.3.4 - Protection Mechanism Bypass
The Page Restriction WordPress (WP) – Protect WP Pages/Post plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 1.3.4. This is due to the plugin not properly restricting access to pages via the REST API when a page has been made private. This makes it possible for unauthenticated attackers to view protected pages. The vendor has decided that they will not implement REST API protection on posts and pages and the restrictions will only apply to the front-end of the site. The vendors solution was to add notices throughout the dashboard and recommends installing the WordPress REST API Authentication plugin for REST API coverage.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-0681?
CVE-2024-0681 is considered a moderate severity vulnerability due to its potential for information disclosure.
How do I fix CVE-2024-0681?
To fix CVE-2024-0681, update the Page Restriction WordPress plugin to version 1.3.5 or later.
What type of information can be disclosed by CVE-2024-0681?
CVE-2024-0681 can disclose private pages and posts via the REST API due to improper access restrictions.
Which versions of the Page Restriction WordPress plugin are affected by CVE-2024-0681?
CVE-2024-0681 affects all versions of the Page Restriction WordPress plugin up to and including 1.3.4.
What is the impact of CVE-2024-0681 on site security?
The impact of CVE-2024-0681 on site security includes unauthorized access to private content, potentially exposing sensitive information.