The vulnerability is a missing authorization flaw in the Restricted Site Access plugin up to version 7.6.2, allowing attackers to bypass the plugin’s site‑wide restriction logic. Attackers can access content that should remain hidden, potentially exposing sensitive information. The flaw corresponds to CWE-862 and hinges on misconfigured access‑control parameters.

The plugin is distributed by 10up for WordPress sites. Every installation that relies on versions of the plugin from the initial release through 7.6.2 is vulnerable. While the plugin itself does not modify core WordPress files, the absence of proper authorization checks means any WordPress site using it can allow unintended visitors to view protected pages or settings.

The CVSS score of 5.3 places the issue in the medium range, and the EPSS score of less than 1% indicates a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred as remote, via benign web requests to a WordPress installation with the plugin deployed and insufficiently configured access levels.