Executive brief
Simple Restrict is a WordPress plugin that controls access to sensitive content by restricting who can view specific posts and pages. The plugin correctly blocks unauthorized users from viewing restricted content on the website's front end, but it has a flaw in how it enforces these restrictions through WordPress's REST API. Attackers with a Contributor account (or higher) can bypass these restrictions and read restricted content they should not have access to by directly querying the REST API.
Technical details
The vulnerability is an authorization bypass (incorrect authorization check, CWE-863) in the REST API endpoint handler. The plugin implements custom permission checks on the front end using its own "simple-restrict-permission" taxonomy-based system, but the REST API endpoints rely instead on generic WordPress capabilities (edit_posts) rather than the plugin's specific permission system. An authenticated user with Contributor role or above can directly request REST endpoints (wp-json/wp/v2/pages/{id}) and retrieve restricted content without possessing the required simple-restrict-permission taxonomy term. Attack requires an active WordPress account with Contributor+ privileges and valid REST nonce authentication. The fix was available in version 1.2.9.
Affected products
- WordPress.org Simple Restrict before 1.2.9
Timeline
- 2026-07-20: disclosed
- 2026-07-20: patched: Fixed in version 1.2.9