WordPress Core <= 7.1 — Authenticated (Author+) Missing Authorization to Comment/Note Reparenting via REST API

Overview

Advisory ID

8b8d4431-ac72-45a2-b4a1-19690946d0ee

Product

WordPress wordpress

Affected

≤7.1

Fixed in

6.6.8, 6.7.8, 6.8.9, 6.9.8, 7.0.5, 7.1.1

Weakness

CWE-862 Missing Authorization

Required access

Unknown

Published

Sep 17, 2026 · updated Nov 13, 2026

Credit

viridis

WordPress Core is vulnerable to Missing Authorization via the REST comments controller update_item_permissions_check() in various versions up to, and including, 7.1 because the target post is not authorized when a comment or note's parent post is changed - only the current parent was checked. This makes it possible for an authenticated attacker who can edit a comment (e.g. an Author editing a comment on their own post) to reparent it onto an arbitrary post, including posts they can neither read nor edit.

Not sure which version you run? Run a passive check — it reads public files only.

Remediation & mitigations

1. Update to one of the following versions, or a newer patched version: 6.6.8, 6.7.8, 6.8.9, 6.9.8, 7.0.5, 7.1.1
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.