The Simple Page Ordering plugin for WordPress is vulnerable to a security issue. This issue exists in versions of the plugin up to and including 2.5.0. A missing capability check on the rest_page_ordering function means that those with a subscriber-level account can access data stored and maintained by the plugin. This data includes information about the structure of the website.