Page and Post Restriction <= 1.6.1 - Unauthenticated Authentication Bypass via REST API Nonce Bypass via Cookie Re-Authentication

Overview

The Page and Post Restriction plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.1 This is due to the papr_restrict_page_post_rest_api() function, hooked on rest_pre_dispatch, re-authenticating the current user from the wordpress_logged_in cookie via wp_set_current_user() for any GET or HEAD REST request where the current user is 0, without verifying a REST nonce — silently undoing the nonce-zeroing that WordPress core's rest_cookie_check_errors() performs on cookie-authenticated requests that lack an X-WP-Nonce header or _wpnonce parameter. Combined with WordPress's permissive REST CORS behavior — which echoes the request Origin and sets Access-Control-Allow-Credentials: true — this allows an unauthenticated attacker to read REST API GET responses as a logged-in victim, exposing role-restricted and private post/page content, victim user profile data via /wp-json/wp/v2/users/me, and comments the victim is authorized to see. This requires the attacker to lure a logged-in user into visiting an attacker-controlled page that issues credentialed cross-origin fetch requests against the target site's REST API; no nonce or further victim interaction beyond the page visit is needed.

Affected

• page_and_post_restriction <= 1.6.1

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.