Restrict User Access CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM Restrict User Access CVE published 2026-09-02

CVE-2026-78153

The Restrict User Access WordPress plugin before 2.8.1 does not normalise the REST API route before checking it against the routes its content protection covers, allowing unauthenticated users to bypass that protection and read restricted content and enumerate users. This vulnerability has a CVSS score of 5.3 and is classified as MEDIUM severity. The vulnerability is caused by the plugin's failure to norm [truncated]