Unauthorized Access in WordPress Core Due to REST API Flaw

CVE-2026-3906

What is CVE-2026-3906?

WordPress Core versions 6.9 through 6.9.1 are susceptible to a security concern involving unauthorized access. The newly introduced Notes feature in these versions allowed users to make editorial comments directly on posts via the block editor. Due to a flaw in the REST API's create_item_permissions_check() method, there is a lack of proper verification to ensure that the authenticated user possesses edit_post permissions on the intended post. This oversight enables authenticated attackers, even those with just Subscriber-level access, to create comments on any post, regardless of authorship, privacy settings, or post status.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References