CVE-2026-15939: Simple Restrict WordPress Auth Bypass

CVE-2026-15939 Overview

CVE-2026-15939 is a broken access control vulnerability [CWE-863] in the Simple Restrict WordPress plugin before version 1.2.9. The plugin fails to enforce its content-restriction permission model on the REST API. Instead of applying the plugin's own permission system, the REST endpoint relies on a generic capability check. Authenticated users with contributor-level access or above can read restricted posts and pages they were never granted access to. The flaw exposes content intended for privileged audiences to any low-privileged authenticated account on the site.

Critical Impact
Contributor-level users can read restricted post and page content through the WordPress REST API, bypassing the plugin's front-end permission checks.

Affected Products

Simple Restrict WordPress plugin versions prior to 1.2.9
WordPress sites using Simple Restrict for content gating
Multi-author WordPress deployments with contributor or higher accounts

Discovery Timeline

2026-08-02 - CVE-2026-15939 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-15939

Vulnerability Analysis

The Simple Restrict plugin implements content restriction on the WordPress front end using its own permission system. This permission system evaluates whether the requesting user has been explicitly granted access to a restricted post or page. On the front end, the plugin correctly filters content before rendering it to the user.

The REST API code path does not apply the same logic. It relies on a generic WordPress capability check, such as verifying that the caller can read posts of a given type. Contributor-level accounts satisfy this generic check because contributors can read posts as part of standard WordPress functionality. The plugin's own access grant list is never consulted, so restricted content is returned in the REST response.

Root Cause

The root cause is inconsistent enforcement of authorization logic between the front-end rendering pipeline and the REST API pipeline. The REST endpoint substitutes a coarse WordPress capability check for the plugin's fine-grained permission system. This pattern is classified under CWE-863: Incorrect Authorization.

Attack Vector

An authenticated attacker with contributor privileges or higher sends a request to the WordPress REST API endpoint for posts or pages. The endpoint returns the full content of items that Simple Restrict marks as restricted. No user interaction is required beyond the authenticated API call. The attacker reads content they were never granted access to through the plugin.

The vulnerability mechanism is described in the WPScan Vulnerability Report. No verified proof-of-concept code is published in the referenced source.

Detection Methods for CVE-2026-15939

Indicators of Compromise

REST API requests to /wp-json/wp/v2/posts or /wp-json/wp/v2/pages from contributor-level accounts returning content flagged as restricted
Unexpected GET requests against restricted post IDs originating from low-privilege session tokens
Access log entries showing enumeration of post IDs via the REST API by non-editor accounts

Detection Strategies

Compare REST API response bodies against the Simple Restrict permission table to identify content served to unauthorized users
Audit WordPress user roles and correlate REST API activity with the plugin's access grant records
Alert on bulk REST API reads of posts by any account below editor level

Monitoring Recommendations

Enable WordPress access logging and forward wp-json request logs to a centralized SIEM
Track authentication events for contributor and author accounts, especially API token usage
Monitor for spikes in REST API traffic that do not correspond to normal editorial workflows

How to Mitigate CVE-2026-15939

Immediate Actions Required

Update the Simple Restrict WordPress plugin to version 1.2.9 or later
Audit contributor and author accounts and remove any that are unused or unrecognized
Review recent REST API access logs for signs of restricted content exposure

Patch Information

The vendor addressed the issue in Simple Restrict version 1.2.9. The fix applies the plugin's own permission system to REST API requests, aligning enforcement with the front-end code path. Site administrators should install the update through the WordPress plugin dashboard or via wp-cli.

Workarounds

Restrict REST API access to authenticated administrators by adding a rest_authentication_errors filter until the plugin is updated
Temporarily disable the Simple Restrict plugin if immediate patching is not feasible and restricted content confidentiality is critical
Reduce user role privileges so that no untrusted account holds contributor or higher access

bash

# Update Simple Restrict via WP-CLI
wp plugin update simple-restrict --version=1.2.9

# Verify installed version
wp plugin get simple-restrict --field=version