PT-2025-23277 · WordPress · Simple Page Access Restriction
Jonas Benjamin Friedli
·
Published
2025-05-30
·
Updated
2025-05-30
·
CVE-2025-5142
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
The Simple Page Access Restriction plugin for WordPress versions up to, and including, 1.0.31
Description
The issue is due to missing nonce validation and capability checks in the settings save handler in the settings.php script. This allows unauthenticated attackers to enable or disable access protection on all post types or taxonomies, force every new page/post to be public or private, cause a silent wipe of all plugin data when it’s later removed, or conduct URL redirection attacks via a forged request if they can trick a site administrator into performing an action such as clicking on a link.
Recommendations
For versions up to, and including, 1.0.31, update to a version later than 1.0.31 to resolve the issue.
As a temporary workaround, consider disabling the settings save handler in the settings.php script until a patch is available.
Restrict access to the settings.php script to minimize the risk of exploitation.
Avoid using the plugin until the issue is resolved.
Fix
CSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Simple Page Access Restriction