CVE-2026-78153

—

CVSS 3.1

5.3 medium

EPSS

<1%p11

Published

Sep 2, 2026 (13d ago)

Modified

Sep 3, 2026

Description

The Restrict User Access WordPress plugin before 2.8.1 does not normalise the REST API route before checking it against the routes its content protection covers, allowing unauthenticated users to bypass that protection and read restricted content and enumerate users.

Ecosystems: WordPress
Weakness: CWE-863
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.2%)

In the news0 stories

No ingested article mentions this CVE yet.