What’s Vulnerable › Vulnerabilities
CVE-2026-78153: Restrict User Access 2.6 - 2.8 - Unauthenticated Content Protection Bypass via REST API Route Normalization
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-02 · updated 2026-09-03
- Weakness: CWE-863
Description
The Restrict User Access WordPress plugin before 2.8.1 does not normalise the REST API route before checking it against the routes its content protection covers, allowing unauthenticated users to bypass that protection and read restricted content and enumerate users.
Affected products
- Restrict User Access: from 2.6 before 2.8.1 — fixed in 2.8.1
How to fix
Upgrade to a fixed version: Restrict User Access 2.8.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-78153 or the next vulnerability affects your stack