SB2026092008 - Multiple vulnerabilities in WordPress

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026092008

SB2026092008 - Multiple vulnerabilities in WordPress

Published: September 20, 2026

Security Bulletin ID SB2026092008
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 10
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 40% Low 60%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 10 vulnerabilities.


1) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to reparent comments onto posts they cannot edit.

The vulnerability exists due to improper authorization in comment reparenting functionality when processing requests to reparent comments. A remote user can send a request to reparent a comment they created on their own post to a post they cannot edit.

An Author role suffices for exploitation.


2) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to modify published posts.

The vulnerability exists due to improper authorization in wp-admin/post.php when handling specially crafted requests. A remote user can send a specially crafted request to modify the title, content, and author of a published post.


3) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose titles of private or draft parent posts.

The vulnerability exists due to missing authorization in attachment_submitbox_metadata() when rendering attachment edit screen metadata. A remote attacker can view the rendered parent-post title to disclose titles of private or draft parent posts.


4) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose URL slugs of draft and pending posts belonging to other users.

The vulnerability exists due to missing authorization in WordPress post access controls when accessing draft and pending posts. A remote user can discover URL slugs of draft and pending posts belonging to other users to disclose URL slugs of draft and pending posts belonging to other users.


5) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote attacker to execute arbitrary script.

The vulnerability exists due to improper neutralization of input during web page generation in the `wpautop()` function when processing a crafted comment. A remote attacker can post a comment containing a KSES-legal element with a newline in an attribute value to execute arbitrary script.

User interaction is required to view the rendered comment.


6) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to read arbitrary .html files on the server.

The vulnerability exists due to improper path validation in the WP REST Templates Controller when processing template IDs. A remote user can submit a crafted template ID to read arbitrary .html files on the server.

Exploitation requires Author permissions.


7) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to publish custom CSS without the edit_css capability.

The vulnerability exists due to improper authorization in the generic XML-RPC wp.newPost path when processing requests for caller-selected registered post types. A remote user can submit a raw customize_changeset post containing custom CSS to publish custom CSS without the edit_css capability.

The issue affects non-Super-Admin site administrators.


8) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute arbitrary script code in a victim's browser.

The vulnerability exists due to improper neutralization of input during web page generation in custom-header preview handling when rendering stored custom-header information. A remote privileged user can store crafted custom-header information to execute arbitrary script code in a victim's browser.

Only themes that support custom headers and do not register an admin-preview-callback are affected.


9) Cross-site request forgery (CVE-ID: N/A)

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to install and preview an inactive theme from WordPress.org.

The vulnerability exists due to cross-site request forgery in the theme installation and preview functionality when an administrator opens a specially crafted URL and logs in when prompted. A remote attacker can trick an administrator into opening a specially crafted URL to install and preview an inactive theme from WordPress.org.

The installed theme remains inactive, but is fully loaded for preview.


10) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to network-activate an installed network-only plugin.

The vulnerability exists due to missing authorization in the Plugins menu when the menu is exposed to site administrators on a Multisite network. A remote user can network-activate a plugin with the network: true header to network-activate an installed network-only plugin.


Remediation

Install update from vendor's website.

References