CVE-2026-78153: Unknown Restrict User Access

Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days.

The Restrict User Access WordPress plugin before 2.8.1 does not normalise the REST API route before checking it against the routes its content protection covers, allowing unauthenticated users to bypass that protection and read restricted content and enumerate users.

Affected products

• Unknown Restrict User Access: from 2.6, before 2.8.1 (fixed in 2.8.1)

Published 2026-09-02. Last modified 2026-09-03.