CVE-2026-78153 — Restrict User Access 2.6 - 2.8 - Unauthenticated Content Protection Bypass via REST API Route Normalization

CVE-2026-78153

Restrict User Access 2.6 - 2.8 - Unauthenticated Content Protection Bypass via REST API Route Normalization PUBLISHED

Description (CNA)

The Restrict User Access WordPress plugin before 2.8.1 does not normalise the REST API route before checking it against the routes its content protection covers, allowing unauthenticated users to bypass that protection and read restricted content and enumerate users.

Affected (CNA)

Vendor / product	Versions
Unknown / Restrict User Access	affected 2.6 before 2.8.1

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/d17c00fc-002a-4f5f-9255-dcc34da89d90/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.