Incorrect authorization in WordPress - #VU158609
Published: November 2, 2026
Vulnerability identifier: #VU158609
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to read, modify, and delete notes on posts they are not authorized to edit.
The vulnerability exists due to improper authorization in the WordPress note update and delete endpoints when handling requests from custom roles with the moderate_comments capability. A remote user can submit requests targeting notes on posts they cannot edit to gain unauthorized access to those notes and modify or delete them.
No default WordPress role is affected.
Affected software
WordPress
Remediation
Install security update from vendor's website.
WordPress - addressed in versions 6.9.11, 7.0.8, 7.1.4