CVE-2024-0909 is a medium severity flaw (CVSS 5.3) in Anonymous Restricted Content plugin. The record gives no fixed version. This guide covers who is affected, how to check your exposure, and what to do now.
What's affected
The Anonymous Restricted Content plugin for WordPress, all versions up to and including 1.6.2.
The record gives a CVSS base score of 5.3 (Medium), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The weakness class is CWE-200.
The record says the plugin protects posts and pages but does not apply those restrictions to the REST API, so unauthenticated visitors can read content that was meant to be restricted.
The record gives no fixed version. The references point to plugin changesets and a Wordfence entry. Check the plugin page for a version above 1.6.2.
How to check if you're exposed
List plugins with WP-CLI: wp plugin list. Look for anonymous-restricted-content and compare the version with 1.6.2. In the dashboard, see Plugins then Installed Plugins.
A free in-browser dependency scan at gold.safeguard.sh/scan can show whether a software package in your own projects matches this CVE, and the Gold directory entry for CVE-2024-0909 keeps the record details in one place. Reachability analysis helps you separate installations where the vulnerable code can actually be hit from those where it sits unused.
For hardware and appliances, no scanner will find them unless they are in an inventory, so start with a list of every device and application of this kind on your network.
What to do now
- Identify every instance of Anonymous Restricted Content plugin in your environment, including test and forgotten systems.
- Compare the version you found with the affected range above.
- Look for a fixed release from the vendor or project. The record gives no fixed version.
- Apply mitigations while you wait: if you cannot update, remove the plugin or restrict the REST API for unauthenticated users until a fixed version is in place.
- Review logs around the affected component for unusual requests.
- Record the decision and a re-check date in your vulnerability tracker.
Why it matters
The weakness is exposure of sensitive information, CWE-200. The plugin offers a protection for content but the REST API provides a second way to ask for the same content, and that route was not covered. It is a common pattern: a rule is enforced on the page route and forgotten on the API route.
The score is Medium because only content confidentiality is affected and nothing is modified. If the protected content is member only material, paid content, or drafts, the impact to your site can still be real.
The record shows this CVE is not in the CISA Known Exploited Vulnerabilities catalog, and none of the pages used for this article report exploitation in the wild.
Quick check
Does this need a login to exploit?
The record says unauthenticated attackers can read the protected content.
Where can I confirm the fixed version?
Check the vendor or project advisory first. The record gives no fixed version. This article is based on the NVD record and the pages listed under Sources.
Sources
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3030199%40anonymous-restricted-content&new=3030199%40anonymous-restricted-content&sfp_email=&sfph_mail=
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3030608%40anonymous-restricted-content&new=3030608%40anonymous-restricted-content&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/f478ff7c-7193-4c59-a84f-c7cafff9b6c0?source=cve
- Safeguard Gold record for CVE-2024-0909
Last reviewed: 19 October 2026.
