WordPress Vulnerabilities

WordPress <= 5.3 - Authenticated Improper Access Controls in REST API

Description

An unprivileged user could make a post sticky via the REST API. Authenticated users who do not have the rights to publish a post were able to mark posts as sticky or unsticky via the REST API. For example, the contributor role does not have such rights, but this allowed them to bypass that.

Affects WordPress

3.8.1
Fixed in WordPress 3.8.32
3.8
Fixed in WordPress 3.8.32
3.7.1
Fixed in WordPress 3.7.32
3.9
Fixed in WordPress 3.9.30
3.9.1
Fixed in WordPress 3.9.30
3.7
Fixed in WordPress 3.7.32
3.8.2
Fixed in WordPress 3.8.32
3.8.3
Fixed in WordPress 3.8.32
3.9.2
Fixed in WordPress 3.9.30
4.0
Fixed in WordPress 4.0.29
4.1
Fixed in WordPress 4.1.29
4.1.1
Fixed in WordPress 4.1.29
4.2
Fixed in WordPress 4.2.26
3.9.3
Fixed in WordPress 3.9.30
4.1.2
Fixed in WordPress 4.1.29
4.2.1
Fixed in WordPress 4.2.26
4.0.1
Fixed in WordPress 4.0.29
4.1.5
Fixed in WordPress 4.1.29
4.1.4
Fixed in WordPress 4.1.29
4.1.3
Fixed in WordPress 4.1.29
3.8.4
Fixed in WordPress 3.8.32
3.7.4
Fixed in WordPress 3.7.32
4.2.3
Fixed in WordPress 4.2.26
3.8.8
Fixed in WordPress 3.8.32
3.8.5
Fixed in WordPress 3.8.32
3.8.6
Fixed in WordPress 3.8.32
3.8.7
Fixed in WordPress 3.8.32
3.7.2
Fixed in WordPress 3.7.32
3.7.3
Fixed in WordPress 3.7.32
3.7.5
Fixed in WordPress 3.7.32
3.7.6
Fixed in WordPress 3.7.32
3.7.7
Fixed in WordPress 3.7.32
3.7.8
Fixed in WordPress 3.7.32
3.7.9
Fixed in WordPress 3.7.32
3.8.9
Fixed in WordPress 3.8.32
3.9.4
Fixed in WordPress 3.9.30
3.9.5
Fixed in WordPress 3.9.30
3.9.6
Fixed in WordPress 3.9.30
3.9.7
Fixed in WordPress 3.9.30
4.0.2
Fixed in WordPress 4.0.29
4.0.3
Fixed in WordPress 4.0.29
4.0.4
Fixed in WordPress 4.0.29
4.0.5
Fixed in WordPress 4.0.29
4.0.6
Fixed in WordPress 4.0.29
4.1.6
Fixed in WordPress 4.1.29
4.2.2
Fixed in WordPress 4.2.26
4.2.4
Fixed in WordPress 4.2.26
4.1.7
Fixed in WordPress 4.1.29
4.0.7
Fixed in WordPress 4.0.29
3.9.8
Fixed in WordPress 3.9.30
3.8.10
Fixed in WordPress 3.8.32
3.7.10
Fixed in WordPress 3.7.32
4.3
Fixed in WordPress 4.3.22
4.3.1
Fixed in WordPress 4.3.22
4.2.5
Fixed in WordPress 4.2.26
4.1.8
Fixed in WordPress 4.1.29
4.0.8
Fixed in WordPress 4.0.29
3.9.9
Fixed in WordPress 3.9.30
3.8.11
Fixed in WordPress 3.8.32
3.7.11
Fixed in WordPress 3.7.32
4.4
Fixed in WordPress 4.4.21
3.7.12
Fixed in WordPress 3.7.32
3.8.12
Fixed in WordPress 3.8.32
3.9.10
Fixed in WordPress 3.9.30
4.0.9
Fixed in WordPress 4.0.29
4.1.9
Fixed in WordPress 4.1.29
4.2.6
Fixed in WordPress 4.2.26
4.3.2
Fixed in WordPress 4.3.22
4.4.1
Fixed in WordPress 4.4.21
4.4.2
Fixed in WordPress 4.4.21
4.3.3
Fixed in WordPress 4.3.22
4.2.7
Fixed in WordPress 4.2.26
4.1.10
Fixed in WordPress 4.1.29
4.0.10
Fixed in WordPress 4.0.29
3.9.11
Fixed in WordPress 3.9.30
3.8.13
Fixed in WordPress 3.8.32
3.7.13
Fixed in WordPress 3.7.32
4.5
Fixed in WordPress 4.5.20
4.5.1
Fixed in WordPress 4.5.20
3.7.14
Fixed in WordPress 3.7.32
3.8.14
Fixed in WordPress 3.8.32
3.9.12
Fixed in WordPress 3.9.30
4.0.11
Fixed in WordPress 4.0.29
4.1.11
Fixed in WordPress 4.1.29
4.2.8
Fixed in WordPress 4.2.26
4.3.4
Fixed in WordPress 4.3.22
4.4.3
Fixed in WordPress 4.4.21
4.5.2
Fixed in WordPress 4.5.20
4.5.3
Fixed in WordPress 4.5.20
3.7.15
Fixed in WordPress 3.7.32
3.8.15
Fixed in WordPress 3.8.32
3.9.13
Fixed in WordPress 3.9.30
4.0.12
Fixed in WordPress 4.0.29
4.1.12
Fixed in WordPress 4.1.29
4.2.9
Fixed in WordPress 4.2.26
4.3.5
Fixed in WordPress 4.3.22
4.4.4
Fixed in WordPress 4.4.21
4.6
Fixed in WordPress 4.6.17
3.7.16
Fixed in WordPress 3.7.32
3.8.16
Fixed in WordPress 3.8.32
3.9.14
Fixed in WordPress 3.9.30
4.0.13
Fixed in WordPress 4.0.29
4.1.13
Fixed in WordPress 4.1.29
4.2.10
Fixed in WordPress 4.2.26
4.3.6
Fixed in WordPress 4.3.22
4.4.5
Fixed in WordPress 4.4.21
4.5.4
Fixed in WordPress 4.5.20
4.6.1
Fixed in WordPress 4.6.17
4.7
Fixed in WordPress 4.7.16
3.7.17
Fixed in WordPress 3.7.32
3.8.17
Fixed in WordPress 3.8.32
3.9.15
Fixed in WordPress 3.9.30
4.0.14
Fixed in WordPress 4.0.29
4.1.14
Fixed in WordPress 4.1.29
4.2.11
Fixed in WordPress 4.2.26
4.3.7
Fixed in WordPress 4.3.22
4.4.6
Fixed in WordPress 4.4.21
4.5.5
Fixed in WordPress 4.5.20
4.7.1
Fixed in WordPress 4.7.16
4.6.2
Fixed in WordPress 4.6.17
3.7.18
Fixed in WordPress 3.7.32
3.8.18
Fixed in WordPress 3.8.32
3.9.16
Fixed in WordPress 3.9.30
4.0.15
Fixed in WordPress 4.0.29
4.1.15
Fixed in WordPress 4.1.29
4.2.12
Fixed in WordPress 4.2.26
4.3.8
Fixed in WordPress 4.3.22
4.4.7
Fixed in WordPress 4.4.21
4.5.6
Fixed in WordPress 4.5.20
4.6.3
Fixed in WordPress 4.6.17
4.7.2
Fixed in WordPress 4.7.16
3.7.19
Fixed in WordPress 3.7.32
3.8.19
Fixed in WordPress 3.8.32
3.9.17
Fixed in WordPress 3.9.30
4.0.16
Fixed in WordPress 4.0.29
4.1.16
Fixed in WordPress 4.1.29
4.2.13
Fixed in WordPress 4.2.26
4.3.9
Fixed in WordPress 4.3.22
4.4.8
Fixed in WordPress 4.4.21
4.5.7
Fixed in WordPress 4.5.20
4.6.4
Fixed in WordPress 4.6.17
4.7.3
Fixed in WordPress 4.7.16
3.7.20
Fixed in WordPress 3.7.32
3.8.20
Fixed in WordPress 3.8.32
3.9.18
Fixed in WordPress 3.9.30
4.0.17
Fixed in WordPress 4.0.29
4.1.17
Fixed in WordPress 4.1.29
4.2.14
Fixed in WordPress 4.2.26
4.3.10
Fixed in WordPress 4.3.22
4.4.9
Fixed in WordPress 4.4.21
4.5.8
Fixed in WordPress 4.5.20
4.6.5
Fixed in WordPress 4.6.17
4.7.4
Fixed in WordPress 4.7.16
4.7.5
Fixed in WordPress 4.7.16
3.7.21
Fixed in WordPress 3.7.32
3.8.21
Fixed in WordPress 3.8.32
3.9.19
Fixed in WordPress 3.9.30
4.0.18
Fixed in WordPress 4.0.29
4.1.18
Fixed in WordPress 4.1.29
4.2.15
Fixed in WordPress 4.2.26
4.3.11
Fixed in WordPress 4.3.22
4.4.10
Fixed in WordPress 4.4.21
4.5.9
Fixed in WordPress 4.5.20
4.6.6
Fixed in WordPress 4.6.17
4.8
Fixed in WordPress 4.8.12
4.8.1
Fixed in WordPress 4.8.12
3.7.22
Fixed in WordPress 3.7.32
3.8.22
Fixed in WordPress 3.8.32
3.9.20
Fixed in WordPress 3.9.30
4.0.19
Fixed in WordPress 4.0.29
4.1.19
Fixed in WordPress 4.1.29
4.2.16
Fixed in WordPress 4.2.26
4.3.12
Fixed in WordPress 4.3.22
4.4.11
Fixed in WordPress 4.4.21
4.5.10
Fixed in WordPress 4.5.20
4.6.7
Fixed in WordPress 4.6.17
4.7.6
Fixed in WordPress 4.7.16
4.8.2
Fixed in WordPress 4.8.12
4.8.3
Fixed in WordPress 4.8.12
3.7.23
Fixed in WordPress 3.7.32
3.8.23
Fixed in WordPress 3.8.32
3.9.21
Fixed in WordPress 3.9.30
4.0.20
Fixed in WordPress 4.0.29
4.1.20
Fixed in WordPress 4.1.29
4.2.17
Fixed in WordPress 4.2.26
4.3.13
Fixed in WordPress 4.3.22
4.4.12
Fixed in WordPress 4.4.21
4.5.11
Fixed in WordPress 4.5.20
4.6.8
Fixed in WordPress 4.6.17
4.7.7
Fixed in WordPress 4.7.16
4.9
Fixed in WordPress 4.9.13
4.9.1
Fixed in WordPress 4.9.13
4.8.4
Fixed in WordPress 4.8.12
4.7.8
Fixed in WordPress 4.7.16
4.6.9
Fixed in WordPress 4.6.17
4.5.12
Fixed in WordPress 4.5.20
4.4.13
Fixed in WordPress 4.4.21
4.3.14
Fixed in WordPress 4.3.22
4.2.18
Fixed in WordPress 4.2.26
4.1.21
Fixed in WordPress 4.1.29
4.0.21
Fixed in WordPress 4.0.29
3.9.22
Fixed in WordPress 3.9.30
3.8.24
Fixed in WordPress 3.8.32
3.7.24
Fixed in WordPress 3.7.32
4.9.2
Fixed in WordPress 4.9.13
4.8.5
Fixed in WordPress 4.8.12
4.7.9
Fixed in WordPress 4.7.16
4.6.10
Fixed in WordPress 4.6.17
4.5.13
Fixed in WordPress 4.5.20
4.4.14
Fixed in WordPress 4.4.21
4.3.15
Fixed in WordPress 4.3.22
4.2.19
Fixed in WordPress 4.2.26
4.1.22
Fixed in WordPress 4.1.29
4.0.22
Fixed in WordPress 4.0.29
3.9.23
Fixed in WordPress 3.9.30
3.8.25
Fixed in WordPress 3.8.32
3.7.25
Fixed in WordPress 3.7.32
4.9.3
Fixed in WordPress 4.9.13
4.9.4
Fixed in WordPress 4.9.13
3.7.26
Fixed in WordPress 3.7.32
3.8.26
Fixed in WordPress 3.8.32
3.9.24
Fixed in WordPress 3.9.30
4.0.23
Fixed in WordPress 4.0.29
4.1.23
Fixed in WordPress 4.1.29
4.2.20
Fixed in WordPress 4.2.26
4.3.16
Fixed in WordPress 4.3.22
4.4.15
Fixed in WordPress 4.4.21
4.5.14
Fixed in WordPress 4.5.20
4.6.11
Fixed in WordPress 4.6.17
4.7.10
Fixed in WordPress 4.7.16
4.8.6
Fixed in WordPress 4.8.12
4.9.5
Fixed in WordPress 4.9.13
4.9.6
Fixed in WordPress 4.9.13
3.7.27
Fixed in WordPress 3.7.32
3.8.27
Fixed in WordPress 3.8.32
3.9.25
Fixed in WordPress 3.9.30
4.0.24
Fixed in WordPress 4.0.29
4.1.24
Fixed in WordPress 4.1.29
4.2.21
Fixed in WordPress 4.2.26
4.3.17
Fixed in WordPress 4.3.22
4.4.16
Fixed in WordPress 4.4.21
4.5.15
Fixed in WordPress 4.5.20
4.6.12
Fixed in WordPress 4.6.17
4.7.11
Fixed in WordPress 4.7.16
4.8.7
Fixed in WordPress 4.8.12
4.9.7
Fixed in WordPress 4.9.13
4.9.8
Fixed in WordPress 4.9.13
5.0
Fixed in WordPress 5.0.8
5.0.1
Fixed in WordPress 5.0.8
4.9.9
Fixed in WordPress 4.9.13
4.8.8
Fixed in WordPress 4.8.12
4.7.12
Fixed in WordPress 4.7.16
4.6.13
Fixed in WordPress 4.6.17
4.5.16
Fixed in WordPress 4.5.20
4.4.17
Fixed in WordPress 4.4.21
4.3.18
Fixed in WordPress 4.3.22
4.2.22
Fixed in WordPress 4.2.26
4.1.25
Fixed in WordPress 4.1.29
4.0.25
Fixed in WordPress 4.0.29
3.9.26
Fixed in WordPress 3.9.30
3.8.28
Fixed in WordPress 3.8.32
3.7.28
Fixed in WordPress 3.7.32
5.0.2
Fixed in WordPress 5.0.8
5.0.3
Fixed in WordPress 5.0.8
5.1
Fixed in WordPress 5.1.4
5.1.1
Fixed in WordPress 5.1.4
5.0.4
Fixed in WordPress 5.0.8
4.9.10
Fixed in WordPress 4.9.13
4.8.9
Fixed in WordPress 4.8.12
4.7.13
Fixed in WordPress 4.7.16
4.6.14
Fixed in WordPress 4.6.17
4.5.17
Fixed in WordPress 4.5.20
4.4.18
Fixed in WordPress 4.4.21
4.3.19
Fixed in WordPress 4.3.22
4.2.23
Fixed in WordPress 4.2.26
4.1.26
Fixed in WordPress 4.1.29
4.0.26
Fixed in WordPress 4.0.29
3.9.27
Fixed in WordPress 3.9.30
3.8.29
Fixed in WordPress 3.8.32
3.7.29
Fixed in WordPress 3.7.32
5.2
Fixed in WordPress 5.2.5
5.2.1
Fixed in WordPress 5.2.5
5.2.2
Fixed in WordPress 5.2.5
5.2.3
Fixed in WordPress 5.2.5
5.1.2
Fixed in WordPress 5.1.4
5.0.6
Fixed in WordPress 5.0.8
4.9.11
Fixed in WordPress 4.9.13
4.8.10
Fixed in WordPress 4.8.12
4.7.14
Fixed in WordPress 4.7.16
4.6.15
Fixed in WordPress 4.6.17
4.5.18
Fixed in WordPress 4.5.20
4.4.19
Fixed in WordPress 4.4.21
4.3.20
Fixed in WordPress 4.3.22
4.2.24
Fixed in WordPress 4.2.26
4.1.27
Fixed in WordPress 4.1.29
4.0.27
Fixed in WordPress 4.0.29
3.9.28
Fixed in WordPress 3.9.30
3.8.30
Fixed in WordPress 3.8.32
3.7.30
Fixed in WordPress 3.7.32
5.2.4
Fixed in WordPress 5.2.5
5.1.3
Fixed in WordPress 5.1.4
5.0.7
Fixed in WordPress 5.0.8
4.9.12
Fixed in WordPress 4.9.13
4.8.11
Fixed in WordPress 4.8.12
4.7.15
Fixed in WordPress 4.7.16
4.6.16
Fixed in WordPress 4.6.17
4.5.19
Fixed in WordPress 4.5.20
4.4.20
Fixed in WordPress 4.4.21
4.3.21
Fixed in WordPress 4.3.22
4.2.25
Fixed in WordPress 4.2.26
4.1.28
Fixed in WordPress 4.1.29
4.0.28
Fixed in WordPress 4.0.29
3.9.29
Fixed in WordPress 3.9.30
3.8.31
Fixed in WordPress 3.8.32
3.7.31
Fixed in WordPress 3.7.32
5.3
Fixed in WordPress 5.3.1

References

CVE
CVE-2019-20043
CVE
CVE-2019-16788
URL
https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-release/
URL
https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-g7rg-hchx-c2gw

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
0.0 (none)

Miscellaneous

Original Researcher
Daniel Bachhuber
Verified
No
WPVDB ID
4a6de154-5fbd-4c80-acd3-8902ee431bd8

Timeline

Publicly Published
2019-12-13 (about 6 years ago)
Added
2019-12-13 (about 6 years ago)
Last Updated
2020-12-15 (about 5 years ago)

Other

Published
Title
Published
2026-07-16
Title
Bricksforge < 3.1.8.7 - Unauthenticated Privilege Escalation via Pro Forms fieldIds Parameter
Published
2025-02-03
Title
Admin and Site Enhancements (ASE) Pro < 7.6.3 - Subscriber+ Privilege Escalation
Published
2025-01-31
Title
WooCommerce Customers Manager < 31.4 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
Published
2025-10-11
Title
Togo < 1.0.4 - Authenticated (subscriber+) Privilege Escalation
Published
2025-04-14
Title
Material Dashboard < 1.4.7 - Unauthenticated Privilege Escalation