WordPress Core <= 7.1 — Missing Authorization to customize_changeset Write via XML-RPC (Multisite/Custom Role edit_css Bypass)

Overview

Advisory ID

28747e2e-9012-470c-a891-0fe97fd1ddba

Product

WordPress wordpress

Affected

≤7.1

Fixed in

6.6.8, 6.7.8, 6.8.9, 6.9.8, 7.0.5, 7.1.1

Weakness

CWE-862 Missing Authorization

Required access

Unknown

Published

Sep 17, 2026 · updated Nov 13, 2026

Credit

Ben Bidner

WordPress Core is vulnerable to an authorization bypass via the XML-RPC _insert_post() handler in various versions up to, and including, 7.1 due to internal-only builtin post types such as customize_changeset being writable through the generic post API, bypassing the customizer's per-setting capability enforcement (notably edit_css/unfiltered_css). A user who can create changesets but lacks edit_css can write changeset values including Additional CSS.

Not sure which version you run? Run a passive check — it reads public files only.

Remediation & mitigations

1. Update to one of the following versions, or a newer patched version: 6.6.8, 6.7.8, 6.8.9, 6.9.8, 7.0.5, 7.1.1
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.