CVE-2026-118194

Name of the Vulnerable Software and Affected Versions Page and Post Restriction versions prior to 1.6.2

Description An authentication bypass exists due to the papr restrict page post rest api() function, which is hooked on rest pre dispatch. The function re-authenticates users from the wordpress logged in cookie using wp set current user() for GET or HEAD REST requests when the current user is 0, without verifying a REST nonce. This action overrides the security check performed by the WordPress core rest cookie check errors() function, which normally zeros the nonce for cookie-authenticated requests missing an X-WP-Nonce header or wpnonce parameter. When combined with permissive Cross-Origin Resource Sharing (CORS) behavior, an unauthenticated attacker can lure a logged-in user to a malicious page to execute credentialed cross-origin fetch requests. This allows the attacker to read REST API GET responses as the victim, exposing private post/page content, comments, and user profile data via the /wp-json/wp/v2/users/me endpoint.

Recommendations Update the plugin to a version newer than 1.6.1. As a temporary mitigation, restrict access to the papr restrict page post rest api() function.