CVE-2026-118194 Page and Post Restriction <= 1.6.1 - Unauthenticated Authentication Bypass via REST API Nonce Bypass via Cookie Re-Authentication

The Page and Post Restriction plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.1 This is due to the paprrestrictpagepostrestapi function, hooked on restpredispatch, re-authenticating the current user from the wordpressloggedin cookie via...

CVE-2026-118194

The Page and Post Restriction plugin for WordPress is vulnerable to Authentication Bypass in versions up to and including 1.6.1 . The root cause is the papr_restrict_page_post_rest_api() function, which re-authenticates users from the wordpress_logged_in cookie via wp_set_current_user() during RE...