CVE-2026-78153: Restrict User Access Plugin Auth Bypass

CVE-2026-78153 Overview

CVE-2026-78153 is an authorization bypass vulnerability in the Restrict User Access WordPress plugin before version 2.8.1. The plugin fails to normalize REST API route paths before matching them against its content protection rules. Unauthenticated attackers can craft non-canonical REST API paths to bypass access restrictions. Successful exploitation permits reading protected content and enumerating registered WordPress users through the REST API. The flaw is categorized under CWE-863: Incorrect Authorization.

Critical Impact
Unauthenticated remote attackers can bypass content protection and enumerate WordPress user accounts, exposing information useful for follow-on credential attacks.

Affected Products

Restrict User Access WordPress plugin versions prior to 2.8.1
WordPress sites relying on the plugin for REST API content restriction
WordPress sites exposing the /wp-json/wp/v2/users endpoint through the plugin's protection layer

Discovery Timeline

2026-09-02 - CVE-2026-78153 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-78153

Vulnerability Analysis

The Restrict User Access plugin enforces content protection by comparing incoming REST API routes to a list of protected routes. The comparison happens on the raw request path rather than a normalized form. Attackers can submit routes containing trailing slashes, alternate casing, URL-encoded characters, or additional path separators. These variants fail the equality check but still resolve to the same underlying WordPress REST endpoint. The result is an authorization decision that diverges from the actual routing decision, which is a classic CWE-863 incorrect authorization pattern.

Root Cause

The root cause is missing input canonicalization before the authorization check. The plugin trusts the request path string as delivered by the client. WordPress core resolves the same endpoint regardless of minor path variations, but the plugin's protection layer treats each variant as a distinct route. This mismatch produces an access control gap that requires no authentication, no user interaction, and no elevated privileges.

Attack Vector

An unauthenticated attacker sends HTTP requests to REST API routes using non-canonical forms. For example, requesting the users endpoint with a trailing slash or URL-encoded characters can slip past the plugin's route matcher. The endpoint then returns restricted content or the standard WordPress user listing, which reveals usernames, display names, and user IDs. Attackers commonly chain this enumeration with password spraying or targeted phishing.

No verified public exploit code is available. See the WPScan Vulnerability Advisory for technical details.

Detection Methods for CVE-2026-78153

Indicators of Compromise

Unauthenticated GET requests to /wp-json/wp/v2/users or variants with trailing slashes, mixed casing, or URL-encoded path segments
Repeated REST API requests from a single source enumerating sequential user IDs
Access log entries returning HTTP 200 for REST routes that should require authentication under the plugin configuration
Spikes in /wp-json/ traffic preceding failed login bursts against /wp-login.php or /xmlrpc.php

Detection Strategies

Compare authenticated versus unauthenticated access patterns to REST routes that the plugin is configured to restrict
Alert when unauthenticated clients receive user objects from /wp-json/wp/v2/users endpoints
Correlate REST enumeration activity with subsequent authentication attempts against the same site

Monitoring Recommendations

Ingest WordPress access logs and web application firewall (WAF) logs into a centralized SIEM for correlation
Track the ratio of /wp-json/ requests to authenticated sessions per source IP
Monitor plugin version inventory across managed WordPress sites and flag installations below 2.8.1

How to Mitigate CVE-2026-78153

Immediate Actions Required

Upgrade the Restrict User Access plugin to version 2.8.1 or later on all WordPress instances
Audit REST API access logs for prior unauthenticated requests to protected routes
Rotate credentials for any accounts whose usernames were exposed through user enumeration

Patch Information

The vendor addressed the issue in Restrict User Access 2.8.1 by normalizing the REST API route before evaluating content protection rules. Site administrators should update through the WordPress plugin manager or WP-CLI. Reference the WPScan Vulnerability Advisory for the confirmed fixed version.

Workarounds

Restrict access to /wp-json/wp/v2/users at the web server or WAF layer for unauthenticated clients
Disable REST API user enumeration by filtering the rest_endpoints hook to remove the users route for anonymous requests
Require authentication for all /wp-json/ traffic where feasible until the plugin is updated

bash

# Update the plugin via WP-CLI
wp plugin update restrict-user-access --version=2.8.1

# Verify the installed version
wp plugin get restrict-user-access --field=version