SB2026092008 - Multiple vulnerabilities in WordPress

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026092008

SB2026092008 - Multiple vulnerabilities in WordPress

Published: September 20, 2026 Updated: November 4, 2026

Security Bulletin ID SB2026092008
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 11
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 36% Low 64%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 11 vulnerabilities.


1) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to reparent comments onto posts they cannot edit.

The vulnerability exists due to improper authorization in comment reparenting functionality when processing requests to reparent comments. A remote user can send a request to reparent a comment they created on their own post to a post they cannot edit.

An Author role suffices for exploitation.


2) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to modify published posts.

The vulnerability exists due to improper authorization in wp-admin/post.php when handling specially crafted requests. A remote user can send a specially crafted request to modify the title, content, and author of a published post.


3) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose titles of private or draft parent posts.

The vulnerability exists due to missing authorization in attachment_submitbox_metadata() when rendering attachment edit screen metadata. A remote attacker can view the rendered parent-post title to disclose titles of private or draft parent posts.


4) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose URL slugs of draft and pending posts belonging to other users.

The vulnerability exists due to missing authorization in WordPress post access controls when accessing draft and pending posts. A remote user can discover URL slugs of draft and pending posts belonging to other users to disclose URL slugs of draft and pending posts belonging to other users.


5) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote attacker to execute arbitrary script.

The vulnerability exists due to improper neutralization of input during web page generation in the `wpautop()` function when processing a crafted comment. A remote attacker can post a comment containing a KSES-legal element with a newline in an attribute value to execute arbitrary script.

User interaction is required to view the rendered comment.


6) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to read arbitrary .html files on the server.

The vulnerability exists due to improper path validation in the WP REST Templates Controller when processing template IDs. A remote user can submit a crafted template ID to read arbitrary .html files on the server.

Exploitation requires Author permissions.


7) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to publish custom CSS without the edit_css capability.

The vulnerability exists due to improper authorization in the generic XML-RPC wp.newPost path when processing requests for caller-selected registered post types. A remote user can submit a raw customize_changeset post containing custom CSS to publish custom CSS without the edit_css capability.

The issue affects non-Super-Admin site administrators.


8) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute arbitrary script code in a victim's browser.

The vulnerability exists due to improper neutralization of input during web page generation in custom-header preview handling when rendering stored custom-header information. A remote privileged user can store crafted custom-header information to execute arbitrary script code in a victim's browser.

Only themes that support custom headers and do not register an admin-preview-callback are affected.


9) Cross-site request forgery (CVE-ID: N/A)

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to install and preview an inactive theme from WordPress.org.

The vulnerability exists due to cross-site request forgery in the theme installation and preview functionality when an administrator opens a specially crafted URL and logs in when prompted. A remote attacker can trick an administrator into opening a specially crafted URL to install and preview an inactive theme from WordPress.org.

The installed theme remains inactive, but is fully loaded for preview.


10) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to network-activate an installed network-only plugin.

The vulnerability exists due to missing authorization in the Plugins menu when the menu is exposed to site administrators on a Multisite network. A remote user can network-activate a plugin with the network: true header to network-activate an installed network-only plugin.


11) Improper Encoding or Escaping of Output (CVE-ID: N/A)

CWE-ID: CWE-116 - Improper Encoding or Escaping of Output

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local privileged user to inject unintended markup into generated HTML.

The vulnerability exists due to improper neutralization of HTML comment-closing sequences in WP_HTML_Tag_Processor's set_modifiable_text() method when processing supplied comment text. A local privileged user can supply specially crafted strings containing abrupt-closing sequences to escape an HTML comment and inject markup, with exploitation requiring user interaction.

The advisory identifies no direct vulnerability in WordPress core or Gutenberg arising from this behavior.


Remediation

Install update from vendor's website.

References