The vulnerability arises from missing nonce validation and capability checks in the settings save handler, enabling unauthenticated attackers to alter protection settings for all post types, force public or private status on new content, delete all plugin data upon removal, or launch URL redirection attacks. These actions compromise the integrity of the site's content and can lead to unintended disclosure or malicious redirects, affecting all users who view the manipulated content. The weakness corresponds to CWE‑352, a classic CSRF flaw.

The affected product is the Simple Page Access Restriction plugin for WordPress, in all versions up to and including 1.0.31. Administrators running a WordPress installation with the plugin installed, particularly those with the plugin's settings interface, are at risk. No other WordPress core versions were listed as affected.

The CVSS base score of 6.5 indicates a moderate impact, and the very low EPSS score (<1%) suggests that exploitation is not widespread, but the risk remains due to the ability to change site‑wide settings and force content visibility. The lack of listing in CISA KEV means no known mass exploitation, yet it should still be addressed promptly. Attackers can exploit by directing an administrator to a crafted request to the plugin’s settings endpoint, bypassing nonce checks.