CVE-2026-114696 miniOrange CVE debrief

Who should care

Defenders responsible for WordPress installations with the Page Restriction plugin should assess exposure and apply patches according to vendor guidance. This includes verifying inventory of installed plugins, assessing exposure of Page Restriction WordPress (WP) plugin, versions up to and including 1.6.0, and applying patches. Security teams should prioritize vulnerability management for affected deployments.

Why it matters

The CVE-2026-114696 vulnerability affects the Page Restriction WordPress (WP) plugin, versions up to and including 1.6.0, and has a CVSS score of 5.3. Defenders should prioritize assessing exposure and applying patches.

• Verify inventory of installed plugins
• Assess exposure of Page Restriction WordPress (WP) plugin, versions up to and including 1.6.0
• Apply patches for the Page Restriction WordPress (WP) plugin, versions up to and including 1.6.0

Technical summary

The Page Restriction WordPress (WP) plugin, versions up to and including 1.6.0, is vulnerable to missing authorization, allowing attackers to exploit incorrectly configured access control security levels. This issue has a CVSS score of 5.3 and is classified as MEDIUM severity. The vulnerability affects WordPress installations with the Page Restriction plugin. Defenders should prioritize assessing exposure and applying patches according to vendor guidance. The vulnerability allows exploitation of incorrectly configured access control security levels.

Defensive priority

Defenders should prioritize assessing exposure and applying patches for the Page Restriction WordPress (WP) plugin, versions up to and including 1.6.0.

Recommended defensive actions

• Assess exposure of Page Restriction WordPress (WP) plugin, versions up to and including 1.6.0
• Apply patches for the Page Restriction WordPress (WP) plugin, versions up to and including 1.6.0
• Verify inventory of installed plugins
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, CVSS score, and affected versions. The official CVE Program record (CVE-2026-114696) and NIST NVD detail page offer source-specific vulnerability assessments. The source item provides additional context on the vulnerability. Defenders should verify inventory, assess exposure, and apply patches. Evidence limits suggest focusing on known affected scope and vendor guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.