blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-78153

MEDIUM 5.3 CVSS 3.1
Published
September 2, 2026
Last modified
September 3, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
Weakness
CWE-863
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Description

The Restrict User Access WordPress plugin before 2.8.1 does not normalise the REST API route before checking it against the routes its content protection covers, allowing unauthenticated users to bypass that protection and read restricted content and enumerate users.

Affected products and versions

  • Unknown Restrict User Access — From 2.6 (including) to 2.8.1 (excluding)

References

  • wpscan.com https://wpscan.com/vulnerability/d17c00fc-002a-4f5f-9255-dcc34da89d90/
  • nvd.nist.gov Official NVD record