CVE-2026-15939

Vulnerability summary (CVE-2026-15939): The Simple Restrict WordPress plugin, versions before 1.2.9, does not enforce its content-restriction permission check on the REST API as it does on the front end, instead relying on a generic capability check. This mismatch allows users with contributor-le...