CVE-2024-11297

HIGH 7.5CVE-2024-11297 · Published 20/12/2024 · updated 17/06/2026

In short

CVE-2024-11297 is a HIGH (CVSS 7.5) vulnerability affecting page restriction (miniorange).
Chance of exploitation in the next 30 days (EPSS): 0.61%, higher than 49.2% of all vulnerabilities.
Fix: update to 1.3.7 or later.

Package	Affected versions	Patched versions
page restriction miniorange	`< 1.3.7`	`1.3.7`

Description

The Page Restriction WordPress (WP) – Protect WP Pages/Post plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.6 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.

References

plugins.trac.wordpress.org/changeset
wordpress.org/plugins/page-and-post-restriction · Product
wordfence.com/threat-intel/vulnerabilities/id/6d12ab8c-d5d0-4e02-986e-e894fae073e5 · Exploit

More vulnerabilities in page restriction

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free