The vulnerability is an authentication bypass caused by the plugin’s REST API handler re‑authenticating a visitor with a valid `wordpress_logged_in` cookie without requiring a REST nonce. This silently restores the user’s session and defeats WordPress core’s nonce zeroing for cookie‑authenticated requests. As a result an unauthenticated attacker can read role‑restricted content, private posts, user profile data through `/wp-json/wp/v2/users/me`, and any comments the victim is allowed to see, simply by having the victim’s browser make a cross‑origin REST GET request.

The flaw exists in the WordPress plugin Page and Post Restriction, developed by cyberlord92, for all releases up to and including version 1.6.1. No newer release information is listed in the data, and the vulnerability was discovered in the plugin’s handling of REST API calls. The affected environment is a WordPress site running this plugin with standard cookie authentication.

The CVSS score of 6.5 indicates moderate severity. EPSS data is unavailable, so the exploitation probability is uncertain, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to lure a logged‑in user to a malicious page that issues credentialed fetch requests to the site’s REST API, taking advantage of WordPress’s permissive CORS that echoes the request Origin and allows `Access‑Control‑Allow‑Credentials`. No further victim interaction is needed beyond visiting the page.