Improper Access Control in WordPress REST API Allows Unauthorized Post Management

CVE-2019-20043

What is CVE-2019-20043?

In WordPress versions 3.7 through 5.3.0, an access control issue exists in the REST API, specifically within the wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php file. This flaw allows authenticated users, such as those with the contributor role who ordinarily lack permission to publish posts, to manipulate post stickiness settings, marking posts as sticky or unsticky. This unintended privilege escalation could lead to unwanted changes in post visibility and organization on the site. The issue has been resolved in WordPress version 5.3.1, which addresses previous versions as well.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References