WordPress Vulnerabilities
WP 6.9 - 7.1.3 - Post Note Disclosure, Modification and Deletion via Comment Moderation Capability
Description
WordPress does not correctly enforce access control on post notes in some cases, which could allow users holding only the comment-moderation capability to read, modify and delete private notes on posts they cannot otherwise edit.
Affects WordPress
Fixed in WordPress 6.9.11
Fixed in WordPress 6.9.11
Fixed in WordPress 6.9.11
Fixed in WordPress 6.9.11
Fixed in WordPress 6.9.11
Fixed in WordPress 6.9.11
Fixed in WordPress 6.9.11
Fixed in WordPress 6.9.11
Fixed in WordPress 6.9.11
Fixed in WordPress 6.9.11
Fixed in WordPress 6.9.11
Fixed in WordPress 7.0.8
Fixed in WordPress 7.0.8
Fixed in WordPress 7.0.8
Fixed in WordPress 7.0.8
Fixed in WordPress 7.0.8
Fixed in WordPress 7.0.8
Fixed in WordPress 7.0.8
Fixed in WordPress 7.0.8
Fixed in WordPress 7.1.4
Fixed in WordPress 7.1.4
Fixed in WordPress 7.1.4
Fixed in WordPress 7.1.4 References
Classification
Type
INCORRECT AUTHORISATION
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Ramon
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2026-10-29 (about 1 day ago)
Added
2026-10-29 (about 18 hours ago)
Last Updated
2026-10-29 (about 18 hours ago)
