CVE-2024-0682: 
WordPress vulnerability analysis and mitigation

The Page Restrict plugin for WordPress contains an information disclosure vulnerability (CVE-2024-0682) affecting all versions up to and including 2.5.5. The vulnerability was discovered and disclosed on February 28, 2024. This security issue affects the WordPress plugin's access control mechanism for private pages (NVD).

The vulnerability stems from the plugin's improper implementation of access restrictions via the REST API when a page has been marked as private. This implementation flaw allows unauthenticated attackers to bypass the intended access controls and view protected posts. The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (Wordfence).

The vulnerability allows unauthorized users to access private pages and posts that should be restricted, potentially exposing sensitive or confidential information. This breach of access control could compromise the confidentiality of protected content on affected WordPress sites (NVD).

The vulnerability can be exploited by unauthenticated attackers remotely through the WordPress REST API. No special privileges or user interaction is required to exploit this vulnerability, making it relatively straightforward to exploit (Wordfence).

The Page Restrict plugin has been closed as of May 31, 2024, and is no longer available for download due to this security issue. Site administrators using the affected plugin should immediately remove it and seek alternative solutions for page restriction functionality (WordPress).