Security Alert Summary
The Restrict User Access WordPress plugin before 2.8.1 fails to normalise REST API routes before comparing them to its content-protection routes. This allows unauthenticated users to bypass those protections, read content intended to be restricted, and enumerate users.
CVE Details
- CVE ID: CVE-2026-78153
- Affected component: Restrict User Access WordPress plugin
- Affected versions: 2.6 and versions less than 2.8.1
- Published: September 2, 2026 at 3:17:39 PM UTC
- Last modified: September 2, 2026 at 3:17:39 PM UTC
- CVSS v3.1: Base score 5.3, MEDIUM —
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Authentication / Privileges / User interaction: No authentication required; privileges required: none; user interaction: none
- Primary impact: Confidentiality: LOW; Integrity: NONE; Availability: NONE
- Weakness: CWE-863 (Incorrect Authorization)
Technical Details
The plugin does not normalise the REST API route before checking it against the set of routes covered by its content-protection logic. Because the route comparison can be bypassed when the incoming REST route is not normalised, unauthenticated requests may be treated as allowed and return content that should be restricted. The description also notes the ability to enumerate users via the same bypass.
No function names or specific REST endpoint paths are provided in the source data; the core issue is a missing or incorrect normalization/check of the REST API route prior to authorization decisions.
Impact is limited to exposure of restricted content and user enumeration under the conditions described. The CVSS data indicates a network-accessible, low-complexity issue that does not require credentials or user interaction.
How This Could Impact Your Website
On a multi-user WordPress site, the site owner or administrators may rely on the Restrict User Access plugin to prevent contractors, contributors, or the public from viewing internal posts or private resources. If an unauthenticated attacker can bypass the route checks, they could read content intended for restricted roles and discover account information for staff or contributors.
Practical consequences include exposure of internal user email addresses and profile data and an increased risk of targeted phishing or social engineering campaigns against staff whose accounts are enumerated. The confidentiality impact is described as low, but the information exposed can still enable follow-on attacks such as targeted credential phishing.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins.
- Monitor site activity and logs for unusual behavior, such as unexpected REST API requests or content access patterns.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
