CVE-2026-114696: WordPress Page Restriction WordPress (WP) plugin <= 1.6.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in miniOrange Page Restriction WordPress (WP) page-and-post-restriction allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Restriction WordPress (WP): from n/a through 1.6.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
miniOrange Page Restriction WordPress (WP)to a version that resolves this vulnerability.Fixed in 1.6.1
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The vulnerability is rated network-accessible and requires no privileges or user interaction. An unauthenticated remote attacker could potentially target an affected installation.
What is the expected impact if exploitation succeeds?
The supplied severity vector indicates low confidentiality impact, with no indicated integrity or availability impact. The issue is therefore associated with unauthorized access to information rather than modification or service disruption.
How can I determine whether an installation is in scope?
Check the installed version of the miniOrange Page Restriction WordPress (WP) plugin. The affected range is listed as through version 1.6.0, with no lower bound specified.