WordPress Vulnerabilities

WP < 7.1.1 - Author+ Unauthorized Note Reparenting via REST API

Description

WordPress does not validate the target post when a comment or note is moved to another post through the REST API in some cases, which could allow users with a role as low as author to attach their own notes to posts they are not allowed to edit.

Affects WordPress

7.1
Fixed in WordPress 7.1.1
7.0.4
Fixed in WordPress 7.0.5
7.0.3
Fixed in WordPress 7.0.5
7.0.2
Fixed in WordPress 7.0.5
7.0.1
Fixed in WordPress 7.0.5
7.0
Fixed in WordPress 7.0.5
6.9.7
Fixed in WordPress 6.9.8
6.9.6
Fixed in WordPress 6.9.8
6.9.5
Fixed in WordPress 6.9.8
6.9.4
Fixed in WordPress 6.9.8
6.9.3
Fixed in WordPress 6.9.8
6.9.2
Fixed in WordPress 6.9.8
6.9.1
Fixed in WordPress 6.9.8
6.9
Fixed in WordPress 6.9.8
6.8.8
Fixed in WordPress 6.8.9
6.8.7
Fixed in WordPress 6.8.9
6.8.6
Fixed in WordPress 6.8.9
6.8.5
Fixed in WordPress 6.8.9
6.8.4
Fixed in WordPress 6.8.9
6.8.3
Fixed in WordPress 6.8.9
6.8.2
Fixed in WordPress 6.8.9
6.8.1
Fixed in WordPress 6.8.9
6.8
Fixed in WordPress 6.8.9
6.7.7
Fixed in WordPress 6.7.8
6.7.6
Fixed in WordPress 6.7.8
6.7.5
Fixed in WordPress 6.7.8
6.7.4
Fixed in WordPress 6.7.8
6.7.3
Fixed in WordPress 6.7.8
6.7.2
Fixed in WordPress 6.7.8
6.7.1
Fixed in WordPress 6.7.8
6.7
Fixed in WordPress 6.7.8
6.6.7
Fixed in WordPress 6.6.8
6.6.6
Fixed in WordPress 6.6.8
6.6.5
Fixed in WordPress 6.6.8
6.6.4
Fixed in WordPress 6.6.8
6.6.3
Fixed in WordPress 6.6.8
6.6.2
Fixed in WordPress 6.6.8
6.6.1
Fixed in WordPress 6.6.8
6.6
Fixed in WordPress 6.6.8
6.5.10
Fixed in WordPress 6.5.11
6.5.9
Fixed in WordPress 6.5.11
6.5.8
Fixed in WordPress 6.5.11
6.5.7
Fixed in WordPress 6.5.11
6.5.6
Fixed in WordPress 6.5.11
6.5.5
Fixed in WordPress 6.5.11
6.5.4
Fixed in WordPress 6.5.11
6.5.3
Fixed in WordPress 6.5.11
6.5.2
Fixed in WordPress 6.5.11
6.5
Fixed in WordPress 6.5.11
6.4.10
Fixed in WordPress 6.4.11
6.4.9
Fixed in WordPress 6.4.11
6.4.8
Fixed in WordPress 6.4.11
6.4.7
Fixed in WordPress 6.4.11
6.4.6
Fixed in WordPress 6.4.11
6.4.5
Fixed in WordPress 6.4.11
6.4.4
Fixed in WordPress 6.4.11
6.4.3
Fixed in WordPress 6.4.11
6.4.2
Fixed in WordPress 6.4.11
6.4.1
Fixed in WordPress 6.4.11
6.4
Fixed in WordPress 6.4.11
6.3.10
Fixed in WordPress 6.3.11
6.3.9
Fixed in WordPress 6.3.11
6.3.8
Fixed in WordPress 6.3.11
6.3.7
Fixed in WordPress 6.3.11
6.3.6
Fixed in WordPress 6.3.11
6.3.5
Fixed in WordPress 6.3.11
6.3.4
Fixed in WordPress 6.3.11
6.3.3
Fixed in WordPress 6.3.11
6.3.2
Fixed in WordPress 6.3.11
6.3.1
Fixed in WordPress 6.3.11
6.3
Fixed in WordPress 6.3.11
6.2.11
Fixed in WordPress 6.2.12
6.2.10
Fixed in WordPress 6.2.12
6.2.9
Fixed in WordPress 6.2.12
6.2.8
Fixed in WordPress 6.2.12
6.2.7
Fixed in WordPress 6.2.12
6.2.6
Fixed in WordPress 6.2.12
6.2.5
Fixed in WordPress 6.2.12
6.2.4
Fixed in WordPress 6.2.12
6.2.3
Fixed in WordPress 6.2.12
6.2.2
Fixed in WordPress 6.2.12
6.2.1
Fixed in WordPress 6.2.12
6.2
Fixed in WordPress 6.2.12
6.1.12
Fixed in WordPress 6.1.13
6.1.11
Fixed in WordPress 6.1.13
6.1.10
Fixed in WordPress 6.1.13
6.1.9
Fixed in WordPress 6.1.13
6.1.8
Fixed in WordPress 6.1.13
6.1.7
Fixed in WordPress 6.1.13
6.1.6
Fixed in WordPress 6.1.13
6.1.5
Fixed in WordPress 6.1.13
6.1.4
Fixed in WordPress 6.1.13
6.1.3
Fixed in WordPress 6.1.13
6.1.2
Fixed in WordPress 6.1.13
6.1.1
Fixed in WordPress 6.1.13
6.1
Fixed in WordPress 6.1.13
6.0.14
Fixed in WordPress 6.0.15
6.0.13
Fixed in WordPress 6.0.15
6.0.12
Fixed in WordPress 6.0.15
6.0.11
Fixed in WordPress 6.0.15
6.0.10
Fixed in WordPress 6.0.15
6.0.9
Fixed in WordPress 6.0.15
6.0.8
Fixed in WordPress 6.0.15
6.0.7
Fixed in WordPress 6.0.15
6.0.6
Fixed in WordPress 6.0.15
6.0.5
Fixed in WordPress 6.0.15
6.0.4
Fixed in WordPress 6.0.15
6.0.3
Fixed in WordPress 6.0.15
6.0.2
Fixed in WordPress 6.0.15
6.0.1
Fixed in WordPress 6.0.15
6.0
Fixed in WordPress 6.0.15
5.9.16
Fixed in WordPress 5.9.17
5.9.15
Fixed in WordPress 5.9.17
5.9.14
Fixed in WordPress 5.9.17
5.9.13
Fixed in WordPress 5.9.17
5.9.12
Fixed in WordPress 5.9.17
5.9.11
Fixed in WordPress 5.9.17
5.9.10
Fixed in WordPress 5.9.17
5.9.9
Fixed in WordPress 5.9.17
5.9.8
Fixed in WordPress 5.9.17
5.9.7
Fixed in WordPress 5.9.17
5.9.6
Fixed in WordPress 5.9.17
5.9.5
Fixed in WordPress 5.9.17
5.9.4
Fixed in WordPress 5.9.17
5.9.3
Fixed in WordPress 5.9.17
5.9.2
Fixed in WordPress 5.9.17
5.9.1
Fixed in WordPress 5.9.17
5.9
Fixed in WordPress 5.9.17
5.8.15
Fixed in WordPress 5.8.16
5.8.14
Fixed in WordPress 5.8.16
5.8.13
Fixed in WordPress 5.8.16
5.8.12
Fixed in WordPress 5.8.16
5.8.11
Fixed in WordPress 5.8.16
5.8.10
Fixed in WordPress 5.8.16
5.8.9
Fixed in WordPress 5.8.16
5.8.8
Fixed in WordPress 5.8.16
5.8.7
Fixed in WordPress 5.8.16
5.8.6
Fixed in WordPress 5.8.16
5.8.5
Fixed in WordPress 5.8.16
5.8.4
Fixed in WordPress 5.8.16
5.8.3
Fixed in WordPress 5.8.16
5.8.2
Fixed in WordPress 5.8.16
5.8.1
Fixed in WordPress 5.8.16
5.8
Fixed in WordPress 5.8.16
5.7.17
Fixed in WordPress 5.7.18
5.7.16
Fixed in WordPress 5.7.18
5.7.15
Fixed in WordPress 5.7.18
5.7.14
Fixed in WordPress 5.7.18
5.7.13
Fixed in WordPress 5.7.18
5.7.12
Fixed in WordPress 5.7.18
5.7.11
Fixed in WordPress 5.7.18
5.7.10
Fixed in WordPress 5.7.18
5.7.9
Fixed in WordPress 5.7.18
5.7.8
Fixed in WordPress 5.7.18
5.7.7
Fixed in WordPress 5.7.18
5.7.6
Fixed in WordPress 5.7.18
5.7.5
Fixed in WordPress 5.7.18
5.7.4
Fixed in WordPress 5.7.18
5.7.3
Fixed in WordPress 5.7.18
5.7.2
Fixed in WordPress 5.7.18
5.7.1
Fixed in WordPress 5.7.18
5.7
Fixed in WordPress 5.7.18
5.6.19
Fixed in WordPress 5.6.20
5.6.18
Fixed in WordPress 5.6.20
5.6.17
Fixed in WordPress 5.6.20
5.6.16
Fixed in WordPress 5.6.20
5.6.15
Fixed in WordPress 5.6.20
5.6.14
Fixed in WordPress 5.6.20
5.6.13
Fixed in WordPress 5.6.20
5.6.12
Fixed in WordPress 5.6.20
5.6.11
Fixed in WordPress 5.6.20
5.6.10
Fixed in WordPress 5.6.20
5.6.9
Fixed in WordPress 5.6.20
5.6.8
Fixed in WordPress 5.6.20
5.6.7
Fixed in WordPress 5.6.20
5.6.6
Fixed in WordPress 5.6.20
5.6.5
Fixed in WordPress 5.6.20
5.6.4
Fixed in WordPress 5.6.20
5.6.3
Fixed in WordPress 5.6.20
5.6.2
Fixed in WordPress 5.6.20
5.6.1
Fixed in WordPress 5.6.20
5.6
Fixed in WordPress 5.6.20
5.5.20
Fixed in WordPress 5.5.21
5.5.19
Fixed in WordPress 5.5.21
5.5.18
Fixed in WordPress 5.5.21
5.5.17
Fixed in WordPress 5.5.21
5.5.16
Fixed in WordPress 5.5.21
5.5.15
Fixed in WordPress 5.5.21
5.5.14
Fixed in WordPress 5.5.21
5.5.13
Fixed in WordPress 5.5.21
5.5.12
Fixed in WordPress 5.5.21
5.5.11
Fixed in WordPress 5.5.21
5.5.10
Fixed in WordPress 5.5.21
5.5.9
Fixed in WordPress 5.5.21
5.5.8
Fixed in WordPress 5.5.21
5.5.7
Fixed in WordPress 5.5.21
5.5.6
Fixed in WordPress 5.5.21
5.5.5
Fixed in WordPress 5.5.21
5.5.4
Fixed in WordPress 5.5.21
5.5.3
Fixed in WordPress 5.5.21
5.5.2
Fixed in WordPress 5.5.21
5.5.1
Fixed in WordPress 5.5.21
5.5
Fixed in WordPress 5.5.21
5.4.21
Fixed in WordPress 5.4.22
5.4.20
Fixed in WordPress 5.4.22
5.4.19
Fixed in WordPress 5.4.22
5.4.18
Fixed in WordPress 5.4.22
5.4.17
Fixed in WordPress 5.4.22
5.4.16
Fixed in WordPress 5.4.22
5.4.15
Fixed in WordPress 5.4.22
5.4.14
Fixed in WordPress 5.4.22
5.4.13
Fixed in WordPress 5.4.22
5.4.12
Fixed in WordPress 5.4.22
5.4.11
Fixed in WordPress 5.4.22
5.4.10
Fixed in WordPress 5.4.22
5.4.9
Fixed in WordPress 5.4.22
5.4.8
Fixed in WordPress 5.4.22
5.4.7
Fixed in WordPress 5.4.22
5.4.6
Fixed in WordPress 5.4.22
5.4.5
Fixed in WordPress 5.4.22
5.4.4
Fixed in WordPress 5.4.22
5.4.3
Fixed in WordPress 5.4.22
5.4.2
Fixed in WordPress 5.4.22
5.4.1
Fixed in WordPress 5.4.22
5.4
Fixed in WordPress 5.4.22
5.3.23
Fixed in WordPress 5.3.24
5.3.22
Fixed in WordPress 5.3.24
5.3.21
Fixed in WordPress 5.3.24
5.3.20
Fixed in WordPress 5.3.24
5.3.19
Fixed in WordPress 5.3.24
5.3.18
Fixed in WordPress 5.3.24
5.3.17
Fixed in WordPress 5.3.24
5.3.16
Fixed in WordPress 5.3.24
5.3.15
Fixed in WordPress 5.3.24
5.3.14
Fixed in WordPress 5.3.24
5.3.13
Fixed in WordPress 5.3.24
5.3.12
Fixed in WordPress 5.3.24
5.3.11
Fixed in WordPress 5.3.24
5.3.10
Fixed in WordPress 5.3.24
5.3.9
Fixed in WordPress 5.3.24
5.3.8
Fixed in WordPress 5.3.24
5.3.7
Fixed in WordPress 5.3.24
5.3.6
Fixed in WordPress 5.3.24
5.3.5
Fixed in WordPress 5.3.24
5.3.4
Fixed in WordPress 5.3.24
5.3.3
Fixed in WordPress 5.3.24
5.3.2
Fixed in WordPress 5.3.24
5.3.1
Fixed in WordPress 5.3.24
5.3
Fixed in WordPress 5.3.24

References

URL
https://wordpress.org/news/2026/09/wordpress-7-1-1-maintenance-and-security-release/

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
2.7 (low)

Miscellaneous

Original Researcher
viridis
Verified
Yes
WPVDB ID
bde07f91-aeb2-4875-88f2-4b18e42e331e

Timeline

Publicly Published
2026-09-17 (about 1 month ago)
Added
2026-09-18 (about 1 month ago)
Last Updated
2026-09-18 (about 1 month ago)

Other

Published
Title
Published
2026-09-10
Title
Booktics – Appointment Booking Calendar for Service Businesses < 1.0.25 - Missing Authorization
Published
2026-10-01
Title
Travelly – Tour & Travel Booking Manager for WooCommerce < 2.3.2 - Missing Authorization
Published
2024-10-25
Title
Download Monitor < 5.0.13 - Missing Authorization to API Key Manipulation
Published
2025-11-07
Title
EventPrime – Events Calendar, Bookings and Tickets < 4.2.0.1 - Missing Authorization to Authenticated (Subscriber+) Booking Note Creation
Published
2026-05-29
Title
Simple History < 5.27.0 - Subscriber+ Account Takeover via Missing Authorization on Event Reaction Endpoint