Vulnerability · Published Sep 2, 2026 · Assigned by WPScan
CVE-2026-78153Restrict User Access 2.6 - 2.8 - Unauthenticated Content Protection Bypass via REST API Route Normalization
Medium 5.3
In plain English
A medium-severity incorrect authorization in Restrict User Access from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.4%top 71.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Restrict User Access WordPress plugin before 2.8.1 does not normalise the REST API route before checking it against the routes its content protection covers, allowing unauthenticated users to bypass that protection and read restricted content and enumerate users.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Restrict User Access | 2.6 – before 2.8.1 |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- https://wpscan.com/vulnerability/d17c00fc-002a-4f5f-9255-dcc34da89d90/ exploit, vdb-entry, technical-description