CVE-2026-15939— Simple Restrict < 1.2.9 - Contributor+ Restricted Content Disclosure via REST API
Possible ATT&CK Techniques 1AI
T1530 · Data from Cloud StorageAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | Simple Restrict | < 1.2.9 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-15939
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Simple Restrict < 1.2.9 - Contributor+ Restricted Content Disclosure via REST API
Source: CVE Program / CVE List V5
Vulnerability Description
The Simple Restrict WordPress plugin before 1.2.9 does not enforce its content-restriction permission check on the REST API the way it does on the front end, relying there on a generic capability check instead of the Simple Restrict WordPress plugin before 1.2.9's own permission system, allowing users with contributor-level access or above to read the content of restricted posts and pages they were never granted access to.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
wpchill simple restrict 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
wpchill simple restrict是wpchill公司开源的一款内容访问限制插件。 wpchill simple restrict 1.2.9之前版本存在授权问题漏洞，该漏洞源于REST API使用通用能力检查代替自身权限系统，允许具有贡献者级别及以上权限的用户读取未授权访问的受限文章和页面内容。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Simple Restrict | 0 ~ 1.2.9 | - |
II. Public POCs for CVE-2026-15939
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-15939
请登录查看更多情报信息。
News Coverage for CVE-2026-15939 (1)
- 🔗 Simple Restrict < 1.2.9 – Contributor+ Restricted Content Disclosure via REST API | CVE 2026-15939 | Plugin Vulnerabilities Read full article exploitvdb-entrytechnical-description
Same Patch Batch · Unknown · 2026-08-02 · 27 CVEs total
| CVE-2026-11872 | Clever Mega Menu for Visual Composer <= 1.0.1 - Subscriber+ Menu Item Meta Update via save | |
| CVE-2026-14864 | JetEngine < 3.8.12 - Contributor+ Stored XSS via jet_engine Shortcode | |
| CVE-2026-14920 | AcyMailing < 10.11.1 - Unauthenticated SQL Injection via subscription[] Parameter | |
| CVE-2026-14841 | King Addons for Elementor < 51.1.76 - Reflected XSS via Posts Grid Widget | |
| CVE-2026-14938 | FluentBoards < 1.95.3 - Subscriber+ Cross-Board Task Disclosure via IDOR | |
| CVE-2026-15151 | Five Star Restaurant Reservations < 2.7.23 - Booking Manager+ Missing Authorization via rt | |
| CVE-2026-15206 | SMS Alert Order Notifications – WooCommerce < 3.9.8 - Unauthenticated Account Takeover via | |
| CVE-2026-16256 | Pouco Import Users <= 1.0.0 - Unauthenticated Privilege Escalation | |
| CVE-2026-15248 | Meta Box < 5.13.1 - Contributor+ Arbitrary Attachment Deletion via IDOR | |
| CVE-2026-15241 | ChatBot for eCommerce – WoowBot < 4.8.4 - Unauthenticated Gemini API Key Abuse via qcld_ge | |
| CVE-2026-15385 | RT Mega Menu < 1.5.2 - Subscriber+ Stored XSS via Menu Item CSS | |
| CVE-2026-12586 | Lenxel WP <= 1.0.31 - Unauthenticated Account Takeover via Arbitrary Password Reset | |
| CVE-2026-14817 | Element Pack Elementor Addons < 8.7.13 - Contributor+ DOM-Based Stored XSS via uikit Data | |
| CVE-2026-15236 | Gallery for Google Photos < 1.2.1 - Unauthenticated Google OAuth Token Disclosure | |
| CVE-2026-16042 | LWS Optimize < 3.4 - Subscriber+ Cache Deletion | |
| CVE-2026-16285 | WooCommerce Product Attachment < 2.3.3 - Unauthenticated Arbitrary Media Download | |
| CVE-2026-16291 | ProfileGrid < 5.9.9.8 - Subscriber+ Arbitrary Notification Deletion via IDOR | |
| CVE-2026-16261 | Huge IT Login <= 1.0.4 - Unauthenticated Account Takeover | |
| CVE-2026-16273 | Narrative Publisher <= 1.0.7 - Contributor+ Stored XSS via narrative_post_script Post Meta | |
| CVE-2026-16292 | Frontend File Manager Plugin <= 23.6 - File Metadata Update via CSRF |
Showing top 20 of 27 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same vendor: Unknown
- CVE-2026-16955
AI Engine < 3.6.6 - Subscriber+ Arbitrary File Read via Audi - CVE-2026-16953
AI Engine < 3.6.4 - Unauthenticated Cross-Session Chatbot Fi - CVE-2026-16595
WP Directory Kit < 1.5.5 - Subscriber+ User and Unpublished - CVE-2026-16608
Download Monitor < 5.2.6 - Unauthenticated Download Log Inje - CVE-2026-16948
Solace Extra < 1.6.1 - Subscriber+ Multiple Missing Authoriz
V. Comments for CVE-2026-15939
No comments yet