Description

The Restrict User Access WordPress plugin before 2.8.1 does not normalise the REST API route before checking it against the routes its content protection covers, allowing unauthenticated users to bypass that protection and read restricted content and enumerate users.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-02T15:17:39.810Z",
  "pubdate": "2026-09-02T15:17:39.810Z",
  "executiveSummary": "The Restrict User Access WordPress plugin is susceptible to an authentication bypass vulnerability due to improper REST API route normalization. This flaw allows unauthenticated, remote attackers to circumvent access control restrictions configured within the plugin. By manipulating the requested REST API path, an attacker can access sensitive content that should be protected and perform user enumeration. The vulnerability exists in all versions prior to 2.8.1. Given that the plugin is designed to gate access to specific content, this vulnerability represents a significant security failure, effectively nullifying the plugin's primary security function. No specialized user privileges are required for exploitation, as the flaw targets the validation logic before authentication or authorization checks are properly applied to the request. The exposure is limited to the public-facing REST API endpoints of the WordPress installation.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient normalization of request URI strings when the Restrict User Access plugin intercepts WordPress REST API calls. In the WordPress environment, REST API routes are registered and tracked; the plugin evaluates incoming requests against its internal 'protected routes' registry to determine if access controls should be enforced. However, the plugin fails to perform canonicalization or consistent normalization on the input path before this comparison occurs.\nBecause the plugin does not normalize the route, an attacker can employ path traversal techniques or utilize URL encoding variations to submit a request that is semantically identical to a protected route but syntactically distinct from the plugin's stored representation. For example, by inserting redundant path elements or utilizing varying URI structures that the underlying server resolves to the same resource, the plugin's access control logic fails to match the incoming request against its list of restricted paths.\nThe attack flow proceeds as follows: 1) The attacker identifies a REST API endpoint protected by the Restrict User Access plugin (e.g., /wp-json/wp/v2/users). 2) The attacker crafts a request using a non-normalized version of this path (e.g., using different slashes or encoding patterns) that the WordPress REST API infrastructure will still successfully resolve to the protected resource. 3) The plugin's security middleware inspects the request but, due to the lack of normalization, fails to recognize the path as one requiring protection. 4) The request is passed through to the core WordPress REST API handlers, which process the request as if it were a standard public access attempt. 5) The sensitive data, such as private content or user list objects, is returned to the unauthenticated attacker.\nThis behavior facilitates unauthorized information disclosure. By bypassing the access control layer, an attacker can scrape protected posts, pages, or custom content types, and systematically enumerate registered users by querying the user-related REST endpoints. This vulnerability is present in all versions prior to 2.8.1 and requires no specific authentication credentials or administrative privileges to execute from a remote network location."
}