CVE-2024-0681: Miniorange Page Restriction Disclosure Flaw

CVE-2024-0681 Overview

The Page Restriction WordPress (WP) – Protect WP Pages/Post plugin by miniorange contains an information disclosure vulnerability affecting all versions up to and including 1.3.4. The plugin fails to enforce access restrictions through the WordPress REST API when a page is marked as private. Unauthenticated remote attackers can retrieve protected page content by querying the REST API directly, bypassing front-end restrictions entirely. The vendor confirmed it will not patch the REST API behavior. Instead, miniorange added dashboard notices and recommends installing the separate WordPress REST API Authentication plugin to cover REST endpoints [CWE-693].

Critical Impact
Unauthenticated attackers can read the contents of pages and posts marked as private through the WordPress REST API, defeating the plugin's core access control purpose.

Affected Products

miniorange Page Restriction WordPress (WP) – Protect WP Pages/Post plugin
All versions up to and including 1.3.4
WordPress sites relying on this plugin for page-level access control

Discovery Timeline

2024-03-13 - CVE-2024-0681 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-0681

Vulnerability Analysis

The Page Restriction plugin implements access control at the WordPress front-end rendering layer only. When an administrator marks a page or post as private, the plugin intercepts standard page requests and blocks unauthorized viewers. However, WordPress exposes the same content objects through the REST API at endpoints such as /wp-json/wp/v2/pages and /wp-json/wp/v2/posts. The plugin does not register REST API permission callbacks or filters that mirror the front-end checks, so the REST layer returns the protected content in JSON form.

The vulnerability aligns with CWE-693 (Protection Mechanism Failure). The mechanism itself functions on the site's public HTML views but does not extend to alternative access paths. Because the REST endpoints are enabled by default on modern WordPress installations, an attacker only needs to know or enumerate page and post IDs to retrieve restricted content.

Root Cause

The root cause is an incomplete authorization model. The plugin hooks WordPress template and query filters used by browser page loads but does not implement rest_prepare_page, rest_prepare_post, or equivalent permission callbacks. The WordPress REST API bypasses the front-end rendering pipeline, so any control logic placed only in that pipeline has no effect on API responses.

Attack Vector

An unauthenticated attacker sends an HTTP GET request to the site's REST API endpoint for pages or posts. No credentials, tokens, or user interaction are required. The response returns the full content of pages that the plugin intended to restrict. Attackers can enumerate page IDs sequentially or use the collection endpoint to list available items. The vendor's guidance is to install a separate REST API authentication plugin rather than patching this behavior, so the exposure persists in default deployments.

// Vulnerability described in prose only - no verified proof-of-concept code is available.
// See the Wordfence advisory referenced below for additional technical detail.

Detection Methods for CVE-2024-0681

Indicators of Compromise

Unauthenticated HTTP GET requests to /wp-json/wp/v2/pages or /wp-json/wp/v2/posts returning content for pages marked private
Repeated sequential requests iterating through numeric page or post IDs from a single source address
Web server access logs showing REST API traffic from clients that never authenticate or load standard page URLs

Detection Strategies

Compare content returned by REST API endpoints against pages marked private in the WordPress admin to identify exposure
Alert on anonymous REST API requests that return HTTP 200 responses for content IDs also flagged as restricted by the plugin
Deploy a Web Application Firewall (WAF) rule that inspects /wp-json/ traffic for unauthenticated reads of protected resources

Monitoring Recommendations

Enable WordPress access logging and forward events to a centralized log platform for correlation and retention
Track REST API request volume per source IP and alert on enumeration-style patterns against wp/v2/pages and wp/v2/posts
Review installed plugins for version 1.3.4 or earlier of miniorange Page Restriction and inventory sites still exposed

How to Mitigate CVE-2024-0681

Immediate Actions Required

Install and configure the WordPress REST API Authentication plugin recommended by miniorange to require authentication on REST endpoints
Restrict or disable public access to /wp-json/wp/v2/pages and /wp-json/wp/v2/posts at the WAF or reverse proxy layer
Audit all pages and posts marked private to determine whether their contents should be considered exposed and rotated or removed

Patch Information

The vendor has stated it will not implement REST API protection within the Page Restriction plugin. Restrictions apply only to the front-end site. See the WordPress Changeset Update for the dashboard notices added by the vendor, and the Wordfence Vulnerability Report for full advisory context. Because no code fix is planned, mitigation requires layered controls outside the plugin itself.

Workarounds

Add an authentication requirement to REST API routes using a dedicated REST API authentication plugin or custom rest_authentication_errors filter
Block anonymous access to /wp-json/wp/v2/pages and /wp-json/wp/v2/posts via .htaccess, Nginx rules, or a WAF policy
Replace the plugin with an access control solution that enforces restrictions across both front-end and REST API layers

bash

# Example Nginx location block to require authentication on REST API content endpoints
location ~ ^/wp-json/wp/v2/(pages|posts) {
    if ($http_authorization = "") {
        return 401;
    }
    try_files $uri $uri/ /index.php?$args;
}