Title: Security Vulnerability
Last modified: July 23, 2026

---

# Security Vulnerability

 *  [groggy72](https://wordpress.org/support/users/groggy72/)
 * (@groggy72)
 * [2 weeks, 3 days ago](https://wordpress.org/support/topic/security-vulnerability-225/)
 * WordPress Content Control Plugin <= 2.6.5 is vulnerable to Broken Access Control
   
   [https://patchstack.com/database/wordpress/plugin/content-control/vulnerability/wordpress-content-control-plugin-2-6-5-broken-access-control-vulnerability](https://patchstack.com/database/wordpress/plugin/content-control/vulnerability/wordpress-content-control-plugin-2-6-5-broken-access-control-vulnerability)

Viewing 5 replies - 1 through 5 (of 5 total)

 *  [linwoodj004](https://wordpress.org/support/users/linwoodj004/)
 * (@linwoodj004)
 * [1 week, 6 days ago](https://wordpress.org/support/topic/security-vulnerability-225/#post-18975458)
 * Following for updates.
 *  Plugin Author [Daniel Iser](https://wordpress.org/support/users/danieliser/)
 * (@danieliser)
 * [1 week, 6 days ago](https://wordpress.org/support/topic/security-vulnerability-225/#post-18975476)
 * Thanks for bringing this to our attention.
 * We confirmed that the endpoint can be queried without authentication in Content
   Control 2.6.5 and earlier. We are preparing an update to tighten it.
 * Based on our review, the scope of the exposure is limited. The endpoint returns
   a small set of global configuration values used by public-facing plugin functionality,
   such as responsive breakpoints and the default denial message.
 * It does not expose restriction definitions, access-control rules, user data, 
   credentials, or license information. It also does not allow an unauthenticated
   visitor to modify settings, bypass a restriction, or access protected content.
 * This is consistent with the CVE’s CVSS 5.3 assessment, which identifies low impact.
   Nevertheless, the endpoint’s access controls should be tightened, and we are 
   addressing that.
 * For transparency, below is the complete response returned by our Pro+ test installation
   with the full plugin suite active and configured:
 *     ```wp-block-code
       {  "settings": {    "mediaQueries": {      "mobile": {        "override": false,        "breakpoint": 640      },      "tablet": {        "override": false,        "breakpoint": 920      },      "desktop": {        "override": false,        "breakpoint": 1440      }    },    "defaultDenialMessage": "Log in to view this content.",    "excludedBlocks": [],    "urlOverrides": [],    "permissions": [],    "excludeAdmins": false  }}
       ```
   
 *  Thread Starter [groggy72](https://wordpress.org/support/users/groggy72/)
 * (@groggy72)
 * [1 week, 6 days ago](https://wordpress.org/support/topic/security-vulnerability-225/#post-18975567)
 * Thank you for addressing this, i look forward to the update
 *  [homepagehelden](https://wordpress.org/support/users/homepagehelden/)
 * (@homepagehelden)
 * [2 days, 1 hour ago](https://wordpress.org/support/topic/security-vulnerability-225/#post-18986860)
 * CVSS 5.3 is a **[Medium](https://www.cve.org/CVERecord?id=CVE-2026-65485)** impact.
   Please address this with higher priority. Thanks!
 *  [Andy](https://wordpress.org/support/users/weibpopmed2020/)
 * (@weibpopmed2020)
 * [1 day, 22 hours ago](https://wordpress.org/support/topic/security-vulnerability-225/#post-18987250)
 * Any update on this Daniel?

Viewing 5 replies - 1 through 5 (of 5 total)

You must be [logged in](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fwordpress.org%2Fsupport%2Ftopic%2Fsecurity-vulnerability-225%2F%3Foutput_format%3Dmd&locale=en_US)
to reply to this topic.

 * ![](https://ps.w.org/content-control/assets/icon-256x256.gif?rev=2968535)
 * [Content Control - The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More](https://wordpress.org/plugins/content-control/)
 * [Frequently Asked Questions](https://wordpress.org/plugins/content-control/#faq)
 * [Support Threads](https://wordpress.org/support/plugin/content-control/)
 * [Active Topics](https://wordpress.org/support/plugin/content-control/active/)
 * [Unresolved Topics](https://wordpress.org/support/plugin/content-control/unresolved/)
 * [Reviews](https://wordpress.org/support/plugin/content-control/reviews/)

## Tags

 * [security issue](https://wordpress.org/support/topic-tag/security-issue/)

 * 5 replies
 * 5 participants
 * Last reply from: [Andy](https://wordpress.org/support/users/weibpopmed2020/)
 * Last activity: [1 day, 22 hours ago](https://wordpress.org/support/topic/security-vulnerability-225/#post-18987250)
 * Status: not resolved