CVE-2024-0965: 
WordPress vulnerability analysis and mitigation

The Simple Page Access Restriction plugin for WordPress contains a Sensitive Information Exposure vulnerability (CVE-2024-0965) affecting all versions up to and including 1.0.21. The vulnerability was discovered and reported by Wordfence, with the initial disclosure made on February 8, 2024 (Wordfence Advisory).

The vulnerability exists in the REST API implementation of the plugin, which allows unauthenticated attackers to bypass the plugin's page restriction mechanisms and view restricted page content. The severity of this vulnerability has been assessed with a CVSS v3.1 Base Score of 5.3 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (NVD).

The vulnerability allows unauthenticated attackers to bypass the plugin's access restrictions and view content that should be restricted. This could lead to unauthorized access to sensitive information that was intended to be protected by the plugin (Wordfence Advisory).

A patch has been released to address this vulnerability. Site administrators are advised to update their Simple Page Access Restriction plugin to a version newer than 1.0.21 (WordPress Plugin).