The Page and Post Restriction plugin for WordPress is vulnerable to sensitive information exposure in versions up to and including 1.4.1. Unauthenticated attackers can retrieve the full rendered content of every published page and post through the REST endpoints /wp-json/wp/v2/pages, /wp-json/wp/v2/pages/<id>, /wp-json/wp/v2/posts, and /wp-json/wp/v2/posts/<id>. This bypasses the intended access restrictions designed to make pages or posts private, exposing potentially confidential site content without authentication. The weakness is a missing authorization check, identified as CWE‑862.

WordPress sites that have the Page and Post Restriction plugin by cyberlord92 installed, with any version up to 1.4.1. Sites that have enabled the global toggles to make all Pages or Posts Private are especially at risk, as the plugin ignores these settings when guarding REST API calls.

The CVSS score of 7.5 indicates a high severity vulnerability. Exploitation requires no credentials; the attacker simply sends a HTTP GET request to the exposed REST endpoints over the public web, making the attack highly feasible. The EPSS score is not available, but the wide usage of WordPress and the common deployment of this plugin suggest a realistic attack probability. The vulnerability is not listed in the CISA KEV catalog at present, but because it can reveal all page and post content, it poses a substantial confidentiality risk if the site hosts valuable or proprietary material.