The vulnerability is a missing authorization flaw in the miniOrange Page Restriction WordPress (WP) plugin that allows an attacker to exploit incorrectly configured access control security levels. The flaw can enable an unauthorized user to gain access to protected pages or posts that should otherwise be restricted, potentially exposing sensitive content and compromising user privacy. The weakness is classified as CWE-862, indicating an access control issue where privileged operations are performed without proper verification.

The affected product is the WordPress Page Restriction WordPress (WP) plugin supplied by miniOrange, impacting all installations running versions from the earliest available release up to and including 1.6.0. No specific version ranges beyond these bounds are listed, so any deployment within this range is potentially vulnerable.

The CVSS score for this issue is 5.3, reflecting moderate severity. The EPSS score is not available, so the current estimate of exploitation likelihood cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through website traffic, where an attacker can request a protected page and receive its contents due to lack of proper permission checks. Any user with access to the WordPress site—whether authenticated or not—could exploit this weakness if the plugin is misconfigured.