CVE-2024-11297: Miniorange Page Restriction Info Leak

CVE-2024-11297 Overview

CVE-2024-11297 affects the Page Restriction WordPress (WP) – Protect WP Pages/Post plugin by miniorange. All plugin versions up to and including 1.3.6 expose restricted content through the WordPress core search feature. Unauthenticated attackers can extract sensitive data from posts intended for higher-privileged roles such as administrators. The flaw is categorized under CWE-200 (Exposure of Sensitive Information) and CWE-203 (Observable Discrepancy). The vulnerability is exploitable over the network without authentication or user interaction.

Critical Impact

Unauthenticated remote attackers can read restricted WordPress posts and pages by abusing the built-in search feature, bypassing the access controls the plugin is designed to enforce.

Affected Products

• miniorange Page Restriction WordPress Plugin versions 1.0 through 1.3.6
• WordPress sites using page-and-post-restriction to gate content by user role
• Deployments where restricted pages or posts contain confidential or administrator-only data

Discovery Timeline

• 2024-12-20 - CVE-2024-11297 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2024-11297

Vulnerability Analysis

The Page Restriction plugin enforces access control at the page and post rendering layer. The plugin checks the current user's role before serving a restricted page and blocks unauthorized viewers. However, this enforcement does not extend to the WordPress core search index. When the search feature queries the posts database, it returns matching content from restricted posts in the search results, including titles and excerpts. An unauthenticated attacker can issue search queries against the site and harvest snippets of content that should only be visible to administrators or other elevated roles. The information exposure scope covers any text indexed by WordPress search, which typically includes post titles, content excerpts, and metadata.

Root Cause

The root cause is incomplete access control coverage. The plugin restricts direct page rendering but does not filter the WordPress query loop that powers ?s= search requests. The plugin fails to register a pre_get_posts filter or equivalent hook to exclude restricted post IDs from search results returned to unauthenticated visitors.

Attack Vector

Exploitation requires no authentication, no user interaction, and only network access to the target site. An attacker browses to the public site and submits search queries through the standard WordPress search endpoint (for example, https://target.example/?s=keyword). Restricted posts matching the query appear in the result list with titles and excerpts rendered to the unauthenticated client. Iterative or dictionary-style search queries can enumerate restricted content systematically.

No verified public proof-of-concept code is available. See the Wordfence Vulnerability Report and the WordPress Plugin Update for the upstream remediation diff.

Detection Methods for CVE-2024-11297

Indicators of Compromise

• Unauthenticated HTTP GET requests to /?s= or /search/ from a single source enumerating many keywords in a short window
• Web server access logs showing search responses containing post slugs or titles that should be role-restricted
• Spikes in wp-json/wp/v2/search API hits referencing protected page IDs

Detection Strategies

• Audit installed plugin versions and flag any page-and-post-restriction installation at or below version 1.3.6
• Compare WordPress search result content against the list of posts marked as restricted by the plugin to identify leakage
• Review WAF or reverse-proxy logs for high-volume search query patterns originating from non-authenticated sessions

Monitoring Recommendations

• Alert on anomalous search query rates against WordPress endpoints from a single IP or ASN
• Monitor outbound HTML responses for content tagged as restricted appearing alongside s= query parameters
• Track plugin version inventory across managed WordPress sites and trigger an alert when vulnerable releases are detected

How to Mitigate CVE-2024-11297

Immediate Actions Required

• Update the Page Restriction WordPress plugin to a version newer than 1.3.6 from the WordPress Plugins directory
• Until the patched version is deployed, disable the plugin or remove sensitive content from posts that rely on it for confidentiality
• Rotate or sanitize any data previously stored in restricted posts that may have been exposed through search

Patch Information

The vendor addressed the issue in a release tracked by changeset 3212690 in the plugin repository. Review the WordPress Plugin Update diff for the exact code changes that exclude restricted posts from search queries.

Workarounds

• Disable the WordPress search feature on affected sites until the plugin is upgraded
• Add a custom pre_get_posts filter in a site-specific plugin or theme to exclude restricted post IDs from search queries
• Place the site behind a WAF rule that blocks unauthenticated access to the ?s= parameter when restricted content categories are in use

# Example WP-CLI commands to inventory and update the affected plugin
wp plugin get page-and-post-restriction --field=version
wp plugin update page-and-post-restriction
wp plugin list --status=active --format=csv | grep page-and-post-restriction