CVE-2026-54852: WordPress Page Restriction WordPress (WP) plugin <= 1.6.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in miniOrange Page Restriction WordPress (WP) page-and-post-restriction allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Restriction WordPress (WP): from n/a through 1.6.1.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
miniOrange Page Restriction WordPress (WP)to a version that resolves this vulnerability.Fixed in 1.6.2
Event History
Frequently Asked Questions
Who can exploit this issue?
The vector is network-accessible and requires no privileges or user interaction. An unauthenticated remote attacker may be able to exploit incorrectly configured access-control security levels.
Which versions are affected?
Page Restriction WordPress (WP) is affected through version 1.6.1. The available information does not identify a fixed version.
What is the likely impact?
The reported impact is limited to confidentiality, with no stated integrity or availability impact. Successful exploitation could expose restricted content where access-control settings are incorrectly configured.