Executive brief
The Restrict User Access WordPress plugin provides content protection by blocking unauthenticated users from accessing protected pages and user information via the REST API. A flaw in how the plugin validates REST API requests allows attackers to bypass this protection by making minor changes to request URLs (such as changing letter case or adding a trailing slash), exposing restricted content and user data without authentication.
Technical details
The vulnerability is a request validation bypass in the Restrict User Access plugin's REST API content protection mechanism. The plugin fails to normalize REST API route parameters before comparing them against its protection rules, allowing case-sensitivity and trailing-slash variations to bypass the protection check. An unauthenticated attacker can exploit this by modifying the request URL (e.g., changing /wp/v2/posts to /wp/v2/Posts or adding a trailing slash) to retrieve protected content collections and individual posts, pages, users, and categories. No authentication or user interaction is required. The vulnerability affects versions 2.6 through 2.8, with a fix available in version 2.8.1.
Affected products
- Restrict User Access Restrict User Access 2.6 through 2.8
Timeline
- 2026-08-31: disclosed: Vulnerability publicly disclosed
- 2026-09-02: patched: Fix released in version 2.8.1
- 2026-09-02: advisory