CVE-2026-78153: Restrict User Access 2.6 - 2.8 - Unauthenticated Content Protection Bypass via REST API Route Normalization
The Restrict User Access WordPress plugin before 2.8.1 does not normalise the REST API route before checking it against the routes its content protection covers, allowing unauthenticated users to bypass that protection and read restricted content and enumerate users.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/restrict-user-accessto a version that resolves this vulnerability.Fixed in 2.8.1 - Configuration
Ensure REST API routes are normalized before comparing them against the routes covered by the plugin’s content protection (fix present in versions 2.8.1 and later).
Restrict User Access WordPress plugin REST API route normalization for protected routes = enabled
Event History
Frequently Asked Questions
Who is exposed to this issue?
WordPress sites using the Restrict User Access plugin in versions before 2.8.1 are affected where the plugin is relied on to protect content through covered REST API routes.
Does an attacker need an account or user interaction to exploit it?
No. The issue is exploitable remotely by an unauthenticated user and does not require user interaction.
What could an attacker obtain?
An attacker may bypass the plugin's REST API content protection to read restricted content and enumerate users.
What is the remediation?
Update Restrict User Access to version 2.8.1 or later.