CVE-2026-15939

Name of the Vulnerable Software and Affected Versions Simple Restrict WordPress plugin versions prior to 1.2.9

Description An issue exists where the plugin fails to enforce its specific content-restriction permission checks when accessing the REST API, unlike its behavior on the front end. Instead, it relies on a generic capability check. This allows users with contributor-level access or higher to read the content of restricted posts and pages for which they have not been granted access.

Recommendations Update Simple Restrict WordPress plugin to version 1.2.9 or later.