The vulnerability in the Restrict User Access plugin arises because the plugin does not normalise incoming REST API routes before checking them against its protection list, allowing unauthenticated users to supply routes that bypass the check. This flaw enables an attacker to read content that should be protected by the plugin, and to enumerate users by probing protected endpoints. The weakness resides in the authorisation process, corresponding to a key‑based authorization bypass described by CWE‑863.

Affected are WordPress sites that use the Restrict User Access plugin prior to version 2.8.1. No specific patch number is announced for earlier versions, so deploying any release 2.8.1 or later removes the flaw. WordPress itself is not directly affected; the issue is limited to that plugin.

The CVSS score of 5.3 classifies the issue as moderate severity. No EPSS value is provided, and the vulnerability is not listed in the CISA KEV catalogue. Although the exploitation probability cannot be quantified, the exploit would rely on a public, unauthenticated REST API request, using a specially crafted route to bypass normalisation. Because the plugin does not enforce authentication or obfuscate its protected routes, any attacker with network access to the site could construct the request and obtain private content.