WordPress Vulnerabilities

WP < 7.1.1 - Contributor+ Arbitrary Post Modification

Description

WordPress does not properly verify that a user is allowed to edit a post when handling a post creation request that names an existing post in some cases, which could allow users with a role as low as contributor to overwrite the title, content and author of any post, including those owned by administrators.

Affects WordPress

7.1
Fixed in WordPress 7.1.1
7.0.4
Fixed in WordPress 7.0.5
7.0.3
Fixed in WordPress 7.0.5
7.0.2
Fixed in WordPress 7.0.5
7.0.1
Fixed in WordPress 7.0.5
7.0
Fixed in WordPress 7.0.5
6.9.7
Fixed in WordPress 6.9.8
6.9.6
Fixed in WordPress 6.9.8
6.9.5
Fixed in WordPress 6.9.8
6.9.4
Fixed in WordPress 6.9.8
6.9.3
Fixed in WordPress 6.9.8
6.9.2
Fixed in WordPress 6.9.8
6.9.1
Fixed in WordPress 6.9.8
6.9
Fixed in WordPress 6.9.8
6.8.8
Fixed in WordPress 6.8.9
6.8.7
Fixed in WordPress 6.8.9
6.8.6
Fixed in WordPress 6.8.9
6.8.5
Fixed in WordPress 6.8.9
6.8.4
Fixed in WordPress 6.8.9
6.8.3
Fixed in WordPress 6.8.9
6.8.2
Fixed in WordPress 6.8.9
6.8.1
Fixed in WordPress 6.8.9
6.8
Fixed in WordPress 6.8.9
6.7.7
Fixed in WordPress 6.7.8
6.7.6
Fixed in WordPress 6.7.8
6.7.5
Fixed in WordPress 6.7.8
6.7.4
Fixed in WordPress 6.7.8
6.7.3
Fixed in WordPress 6.7.8
6.7.2
Fixed in WordPress 6.7.8
6.7.1
Fixed in WordPress 6.7.8
6.7
Fixed in WordPress 6.7.8
6.6.7
Fixed in WordPress 6.6.8
6.6.6
Fixed in WordPress 6.6.8
6.6.5
Fixed in WordPress 6.6.8
6.6.4
Fixed in WordPress 6.6.8
6.6.3
Fixed in WordPress 6.6.8
6.6.2
Fixed in WordPress 6.6.8
6.6.1
Fixed in WordPress 6.6.8
6.6
Fixed in WordPress 6.6.8
6.5.10
Fixed in WordPress 6.5.11
6.5.9
Fixed in WordPress 6.5.11
6.5.8
Fixed in WordPress 6.5.11
6.5.7
Fixed in WordPress 6.5.11
6.5.6
Fixed in WordPress 6.5.11
6.5.5
Fixed in WordPress 6.5.11
6.5.4
Fixed in WordPress 6.5.11
6.5.3
Fixed in WordPress 6.5.11
6.5.2
Fixed in WordPress 6.5.11
6.5
Fixed in WordPress 6.5.11
6.4.10
Fixed in WordPress 6.4.11
6.4.9
Fixed in WordPress 6.4.11
6.4.8
Fixed in WordPress 6.4.11
6.4.7
Fixed in WordPress 6.4.11
6.4.6
Fixed in WordPress 6.4.11
6.4.5
Fixed in WordPress 6.4.11
6.4.4
Fixed in WordPress 6.4.11
6.4.3
Fixed in WordPress 6.4.11
6.4.2
Fixed in WordPress 6.4.11
6.4.1
Fixed in WordPress 6.4.11
6.4
Fixed in WordPress 6.4.11
6.3.10
Fixed in WordPress 6.3.11
6.3.9
Fixed in WordPress 6.3.11
6.3.8
Fixed in WordPress 6.3.11
6.3.7
Fixed in WordPress 6.3.11
6.3.6
Fixed in WordPress 6.3.11
6.3.5
Fixed in WordPress 6.3.11
6.3.4
Fixed in WordPress 6.3.11
6.3.3
Fixed in WordPress 6.3.11
6.3.2
Fixed in WordPress 6.3.11
6.3.1
Fixed in WordPress 6.3.11
6.3
Fixed in WordPress 6.3.11
6.2.11
Fixed in WordPress 6.2.12
6.2.10
Fixed in WordPress 6.2.12
6.2.9
Fixed in WordPress 6.2.12
6.2.8
Fixed in WordPress 6.2.12
6.2.7
Fixed in WordPress 6.2.12
6.2.6
Fixed in WordPress 6.2.12
6.2.5
Fixed in WordPress 6.2.12
6.2.4
Fixed in WordPress 6.2.12
6.2.3
Fixed in WordPress 6.2.12
6.2.2
Fixed in WordPress 6.2.12
6.2.1
Fixed in WordPress 6.2.12
6.2
Fixed in WordPress 6.2.12
6.1.12
Fixed in WordPress 6.1.13
6.1.11
Fixed in WordPress 6.1.13
6.1.10
Fixed in WordPress 6.1.13
6.1.9
Fixed in WordPress 6.1.13
6.1.8
Fixed in WordPress 6.1.13
6.1.7
Fixed in WordPress 6.1.13
6.1.6
Fixed in WordPress 6.1.13
6.1.5
Fixed in WordPress 6.1.13
6.1.4
Fixed in WordPress 6.1.13
6.1.3
Fixed in WordPress 6.1.13
6.1.2
Fixed in WordPress 6.1.13
6.1.1
Fixed in WordPress 6.1.13
6.1
Fixed in WordPress 6.1.13
6.0.14
Fixed in WordPress 6.0.15
6.0.13
Fixed in WordPress 6.0.15
6.0.12
Fixed in WordPress 6.0.15
6.0.11
Fixed in WordPress 6.0.15
6.0.10
Fixed in WordPress 6.0.15
6.0.9
Fixed in WordPress 6.0.15
6.0.8
Fixed in WordPress 6.0.15
6.0.7
Fixed in WordPress 6.0.15
6.0.6
Fixed in WordPress 6.0.15
6.0.5
Fixed in WordPress 6.0.15
6.0.4
Fixed in WordPress 6.0.15
6.0.3
Fixed in WordPress 6.0.15
6.0.2
Fixed in WordPress 6.0.15
6.0.1
Fixed in WordPress 6.0.15
6.0
Fixed in WordPress 6.0.15
5.9.16
Fixed in WordPress 5.9.17
5.9.15
Fixed in WordPress 5.9.17
5.9.14
Fixed in WordPress 5.9.17
5.9.13
Fixed in WordPress 5.9.17
5.9.12
Fixed in WordPress 5.9.17
5.9.11
Fixed in WordPress 5.9.17
5.9.10
Fixed in WordPress 5.9.17
5.9.9
Fixed in WordPress 5.9.17
5.9.8
Fixed in WordPress 5.9.17
5.9.7
Fixed in WordPress 5.9.17
5.9.6
Fixed in WordPress 5.9.17
5.9.5
Fixed in WordPress 5.9.17
5.9.4
Fixed in WordPress 5.9.17
5.9.3
Fixed in WordPress 5.9.17
5.9.2
Fixed in WordPress 5.9.17
5.9.1
Fixed in WordPress 5.9.17
5.9
Fixed in WordPress 5.9.17
5.8.15
Fixed in WordPress 5.8.16
5.8.14
Fixed in WordPress 5.8.16
5.8.13
Fixed in WordPress 5.8.16
5.8.12
Fixed in WordPress 5.8.16
5.8.11
Fixed in WordPress 5.8.16
5.8.10
Fixed in WordPress 5.8.16
5.8.9
Fixed in WordPress 5.8.16
5.8.8
Fixed in WordPress 5.8.16
5.8.7
Fixed in WordPress 5.8.16
5.8.6
Fixed in WordPress 5.8.16
5.8.5
Fixed in WordPress 5.8.16
5.8.4
Fixed in WordPress 5.8.16
5.8.3
Fixed in WordPress 5.8.16
5.8.2
Fixed in WordPress 5.8.16
5.8.1
Fixed in WordPress 5.8.16
5.8
Fixed in WordPress 5.8.16
5.7.17
Fixed in WordPress 5.7.18
5.7.16
Fixed in WordPress 5.7.18
5.7.15
Fixed in WordPress 5.7.18
5.7.14
Fixed in WordPress 5.7.18
5.7.13
Fixed in WordPress 5.7.18
5.7.12
Fixed in WordPress 5.7.18
5.7.11
Fixed in WordPress 5.7.18
5.7.10
Fixed in WordPress 5.7.18
5.7.9
Fixed in WordPress 5.7.18
5.7.8
Fixed in WordPress 5.7.18
5.7.7
Fixed in WordPress 5.7.18
5.7.6
Fixed in WordPress 5.7.18
5.7.5
Fixed in WordPress 5.7.18
5.7.4
Fixed in WordPress 5.7.18
5.7.3
Fixed in WordPress 5.7.18
5.7.2
Fixed in WordPress 5.7.18
5.7.1
Fixed in WordPress 5.7.18
5.7
Fixed in WordPress 5.7.18
5.6.19
Fixed in WordPress 5.6.20
5.6.18
Fixed in WordPress 5.6.20
5.6.17
Fixed in WordPress 5.6.20
5.6.16
Fixed in WordPress 5.6.20
5.6.15
Fixed in WordPress 5.6.20
5.6.14
Fixed in WordPress 5.6.20
5.6.13
Fixed in WordPress 5.6.20
5.6.12
Fixed in WordPress 5.6.20
5.6.11
Fixed in WordPress 5.6.20
5.6.10
Fixed in WordPress 5.6.20
5.6.9
Fixed in WordPress 5.6.20
5.6.8
Fixed in WordPress 5.6.20
5.6.7
Fixed in WordPress 5.6.20
5.6.6
Fixed in WordPress 5.6.20
5.6.5
Fixed in WordPress 5.6.20
5.6.4
Fixed in WordPress 5.6.20
5.6.3
Fixed in WordPress 5.6.20
5.6.2
Fixed in WordPress 5.6.20
5.6.1
Fixed in WordPress 5.6.20
5.6
Fixed in WordPress 5.6.20
5.5.20
Fixed in WordPress 5.5.21
5.5.19
Fixed in WordPress 5.5.21
5.5.18
Fixed in WordPress 5.5.21
5.5.17
Fixed in WordPress 5.5.21
5.5.16
Fixed in WordPress 5.5.21
5.5.15
Fixed in WordPress 5.5.21
5.5.14
Fixed in WordPress 5.5.21
5.5.13
Fixed in WordPress 5.5.21
5.5.12
Fixed in WordPress 5.5.21
5.5.11
Fixed in WordPress 5.5.21
5.5.10
Fixed in WordPress 5.5.21
5.5.9
Fixed in WordPress 5.5.21
5.5.8
Fixed in WordPress 5.5.21
5.5.7
Fixed in WordPress 5.5.21
5.5.6
Fixed in WordPress 5.5.21
5.5.5
Fixed in WordPress 5.5.21
5.5.4
Fixed in WordPress 5.5.21
5.5.3
Fixed in WordPress 5.5.21
5.5.2
Fixed in WordPress 5.5.21
5.5.1
Fixed in WordPress 5.5.21
5.5
Fixed in WordPress 5.5.21
5.4.21
Fixed in WordPress 5.4.22
5.4.20
Fixed in WordPress 5.4.22
5.4.19
Fixed in WordPress 5.4.22
5.4.18
Fixed in WordPress 5.4.22
5.4.17
Fixed in WordPress 5.4.22
5.4.16
Fixed in WordPress 5.4.22
5.4.15
Fixed in WordPress 5.4.22
5.4.14
Fixed in WordPress 5.4.22
5.4.13
Fixed in WordPress 5.4.22
5.4.12
Fixed in WordPress 5.4.22
5.4.11
Fixed in WordPress 5.4.22
5.4.10
Fixed in WordPress 5.4.22
5.4.9
Fixed in WordPress 5.4.22
5.4.8
Fixed in WordPress 5.4.22
5.4.7
Fixed in WordPress 5.4.22
5.4.6
Fixed in WordPress 5.4.22
5.4.5
Fixed in WordPress 5.4.22
5.4.4
Fixed in WordPress 5.4.22
5.4.3
Fixed in WordPress 5.4.22
5.4.2
Fixed in WordPress 5.4.22
5.4.1
Fixed in WordPress 5.4.22
5.4
Fixed in WordPress 5.4.22
5.3.23
Fixed in WordPress 5.3.24
5.3.22
Fixed in WordPress 5.3.24
5.3.21
Fixed in WordPress 5.3.24
5.3.20
Fixed in WordPress 5.3.24
5.3.19
Fixed in WordPress 5.3.24
5.3.18
Fixed in WordPress 5.3.24
5.3.17
Fixed in WordPress 5.3.24
5.3.16
Fixed in WordPress 5.3.24
5.3.15
Fixed in WordPress 5.3.24
5.3.14
Fixed in WordPress 5.3.24
5.3.13
Fixed in WordPress 5.3.24
5.3.12
Fixed in WordPress 5.3.24
5.3.11
Fixed in WordPress 5.3.24
5.3.10
Fixed in WordPress 5.3.24
5.3.9
Fixed in WordPress 5.3.24
5.3.8
Fixed in WordPress 5.3.24
5.3.7
Fixed in WordPress 5.3.24
5.3.6
Fixed in WordPress 5.3.24
5.3.5
Fixed in WordPress 5.3.24
5.3.4
Fixed in WordPress 5.3.24
5.3.3
Fixed in WordPress 5.3.24
5.3.2
Fixed in WordPress 5.3.24
5.3.1
Fixed in WordPress 5.3.24
5.3
Fixed in WordPress 5.3.24
5.2.26
Fixed in WordPress 5.2.27
5.2.25
Fixed in WordPress 5.2.27
5.2.24
Fixed in WordPress 5.2.27
5.2.23
Fixed in WordPress 5.2.27
5.2.22
Fixed in WordPress 5.2.27
5.2.21
Fixed in WordPress 5.2.27
5.2.20
Fixed in WordPress 5.2.27
5.2.19
Fixed in WordPress 5.2.27
5.2.18
Fixed in WordPress 5.2.27
5.2.17
Fixed in WordPress 5.2.27
5.2.16
Fixed in WordPress 5.2.27
5.2.15
Fixed in WordPress 5.2.27
5.2.14
Fixed in WordPress 5.2.27
5.2.13
Fixed in WordPress 5.2.27
5.2.12
Fixed in WordPress 5.2.27
5.2.11
Fixed in WordPress 5.2.27
5.2.10
Fixed in WordPress 5.2.27
5.2.9
Fixed in WordPress 5.2.27
5.2.8
Fixed in WordPress 5.2.27
5.2.7
Fixed in WordPress 5.2.27
5.2.6
Fixed in WordPress 5.2.27
5.2.5
Fixed in WordPress 5.2.27
5.2.4
Fixed in WordPress 5.2.27
5.2.3
Fixed in WordPress 5.2.27
5.2.2
Fixed in WordPress 5.2.27
5.2.1
Fixed in WordPress 5.2.27
5.2
Fixed in WordPress 5.2.27
5.1.24
Fixed in WordPress 5.1.25
5.1.23
Fixed in WordPress 5.1.25
5.1.22
Fixed in WordPress 5.1.25
5.1.21
Fixed in WordPress 5.1.25
5.1.20
Fixed in WordPress 5.1.25
5.1.19
Fixed in WordPress 5.1.25
5.1.18
Fixed in WordPress 5.1.25
5.1.17
Fixed in WordPress 5.1.25
5.1.16
Fixed in WordPress 5.1.25
5.1.15
Fixed in WordPress 5.1.25
5.1.14
Fixed in WordPress 5.1.25
5.1.13
Fixed in WordPress 5.1.25
5.1.12
Fixed in WordPress 5.1.25
5.1.11
Fixed in WordPress 5.1.25
5.1.10
Fixed in WordPress 5.1.25
5.1.9
Fixed in WordPress 5.1.25
5.1.8
Fixed in WordPress 5.1.25
5.1.7
Fixed in WordPress 5.1.25
5.1.6
Fixed in WordPress 5.1.25
5.1.5
Fixed in WordPress 5.1.25
5.1.4
Fixed in WordPress 5.1.25
5.1.3
Fixed in WordPress 5.1.25
5.1.2
Fixed in WordPress 5.1.25
5.1.1
Fixed in WordPress 5.1.25
5.1
Fixed in WordPress 5.1.25
5.0.27
Fixed in WordPress 5.0.28
5.0.26
Fixed in WordPress 5.0.28
5.0.25
Fixed in WordPress 5.0.28
5.0.24
Fixed in WordPress 5.0.28
5.0.23
Fixed in WordPress 5.0.28
5.0.22
Fixed in WordPress 5.0.28
5.0.21
Fixed in WordPress 5.0.28
5.0.20
Fixed in WordPress 5.0.28
5.0.19
Fixed in WordPress 5.0.28
5.0.18
Fixed in WordPress 5.0.28
5.0.17
Fixed in WordPress 5.0.28
5.0.16
Fixed in WordPress 5.0.28
5.0.15
Fixed in WordPress 5.0.28
5.0.14
Fixed in WordPress 5.0.28
5.0.13
Fixed in WordPress 5.0.28
5.0.12
Fixed in WordPress 5.0.28
5.0.11
Fixed in WordPress 5.0.28
5.0.10
Fixed in WordPress 5.0.28
5.0.9
Fixed in WordPress 5.0.28
5.0.8
Fixed in WordPress 5.0.28
5.0.7
Fixed in WordPress 5.0.28
5.0.6
Fixed in WordPress 5.0.28
5.0.4
Fixed in WordPress 5.0.28
5.0.3
Fixed in WordPress 5.0.28
5.0.2
Fixed in WordPress 5.0.28
5.0.1
Fixed in WordPress 5.0.28
5.0
Fixed in WordPress 5.0.28
4.9.31
Fixed in WordPress 4.9.32
4.9.30
Fixed in WordPress 4.9.32
4.9.29
Fixed in WordPress 4.9.32
4.9.28
Fixed in WordPress 4.9.32
4.9.27
Fixed in WordPress 4.9.32
4.9.26
Fixed in WordPress 4.9.32
4.9.25
Fixed in WordPress 4.9.32
4.9.24
Fixed in WordPress 4.9.32
4.9.23
Fixed in WordPress 4.9.32
4.9.22
Fixed in WordPress 4.9.32
4.9.21
Fixed in WordPress 4.9.32
4.9.20
Fixed in WordPress 4.9.32
4.9.19
Fixed in WordPress 4.9.32
4.9.18
Fixed in WordPress 4.9.32
4.9.17
Fixed in WordPress 4.9.32
4.9.16
Fixed in WordPress 4.9.32
4.9.15
Fixed in WordPress 4.9.32
4.9.14
Fixed in WordPress 4.9.32
4.9.13
Fixed in WordPress 4.9.32
4.9.12
Fixed in WordPress 4.9.32
4.9.11
Fixed in WordPress 4.9.32
4.9.10
Fixed in WordPress 4.9.32
4.9.9
Fixed in WordPress 4.9.32
4.9.8
Fixed in WordPress 4.9.32
4.9.7
Fixed in WordPress 4.9.32
4.9.6
Fixed in WordPress 4.9.32
4.9.5
Fixed in WordPress 4.9.32
4.9.4
Fixed in WordPress 4.9.32
4.9.3
Fixed in WordPress 4.9.32
4.9.2
Fixed in WordPress 4.9.32
4.9.1
Fixed in WordPress 4.9.32
4.9
Fixed in WordPress 4.9.32
4.8.30
Fixed in WordPress 4.8.31
4.8.29
Fixed in WordPress 4.8.31
4.8.28
Fixed in WordPress 4.8.31
4.8.27
Fixed in WordPress 4.8.31
4.8.26
Fixed in WordPress 4.8.31
4.8.25
Fixed in WordPress 4.8.31
4.8.24
Fixed in WordPress 4.8.31
4.8.23
Fixed in WordPress 4.8.31
4.8.22
Fixed in WordPress 4.8.31
4.8.21
Fixed in WordPress 4.8.31
4.8.20
Fixed in WordPress 4.8.31
4.8.19
Fixed in WordPress 4.8.31
4.8.18
Fixed in WordPress 4.8.31
4.8.17
Fixed in WordPress 4.8.31
4.8.16
Fixed in WordPress 4.8.31
4.8.15
Fixed in WordPress 4.8.31
4.8.14
Fixed in WordPress 4.8.31
4.8.13
Fixed in WordPress 4.8.31
4.8.12
Fixed in WordPress 4.8.31
4.8.11
Fixed in WordPress 4.8.31
4.8.10
Fixed in WordPress 4.8.31
4.8.9
Fixed in WordPress 4.8.31
4.8.8
Fixed in WordPress 4.8.31
4.8.7
Fixed in WordPress 4.8.31
4.8.6
Fixed in WordPress 4.8.31
4.8.5
Fixed in WordPress 4.8.31
4.8.4
Fixed in WordPress 4.8.31
4.8.3
Fixed in WordPress 4.8.31
4.8.2
Fixed in WordPress 4.8.31
4.8.1
Fixed in WordPress 4.8.31
4.8
Fixed in WordPress 4.8.31
4.7.35
Fixed in WordPress 4.7.36
4.7.34
Fixed in WordPress 4.7.36
4.7.33
Fixed in WordPress 4.7.36
4.7.32
Fixed in WordPress 4.7.36
4.7.31
Fixed in WordPress 4.7.36
4.7.30
Fixed in WordPress 4.7.36
4.7.29
Fixed in WordPress 4.7.36
4.7.28
Fixed in WordPress 4.7.36
4.7.27
Fixed in WordPress 4.7.36
4.7.26
Fixed in WordPress 4.7.36
4.7.25
Fixed in WordPress 4.7.36
4.7.24
Fixed in WordPress 4.7.36
4.7.23
Fixed in WordPress 4.7.36
4.7.22
Fixed in WordPress 4.7.36
4.7.21
Fixed in WordPress 4.7.36
4.7.20
Fixed in WordPress 4.7.36
4.7.19
Fixed in WordPress 4.7.36
4.7.18
Fixed in WordPress 4.7.36
4.7.17
Fixed in WordPress 4.7.36
4.7.16
Fixed in WordPress 4.7.36
4.7.15
Fixed in WordPress 4.7.36
4.7.14
Fixed in WordPress 4.7.36
4.7.13
Fixed in WordPress 4.7.36
4.7.12
Fixed in WordPress 4.7.36
4.7.11
Fixed in WordPress 4.7.36
4.7.10
Fixed in WordPress 4.7.36
4.7.9
Fixed in WordPress 4.7.36
4.7.8
Fixed in WordPress 4.7.36
4.7.7
Fixed in WordPress 4.7.36
4.7.6
Fixed in WordPress 4.7.36
4.7.5
Fixed in WordPress 4.7.36
4.7.4
Fixed in WordPress 4.7.36
4.7.3
Fixed in WordPress 4.7.36
4.7.2
Fixed in WordPress 4.7.36
4.7.1
Fixed in WordPress 4.7.36
4.7
Fixed in WordPress 4.7.36

References

URL
https://wordpress.org/news/2026/09/wordpress-7-1-1-maintenance-and-security-release/

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.9 (medium)

Miscellaneous

Original Researcher
Anthropic
Verified
Yes
WPVDB ID
e32e8e71-7618-42a7-8a1c-b00750e8581b

Timeline

Publicly Published
2026-09-17 (about 1 month ago)
Added
2026-09-18 (about 1 month ago)
Last Updated
2026-09-18 (about 1 month ago)

Other

Published
Title
Published
2026-09-18
Title
Easy Appointments < 3.12.28 - Missing Authorization to Authenticated (Contributor+) Sensitive Customer Information Exposure via ea_get_customers_ajax AJAX Action
Published
2026-10-16
Title
AI Engine < 3.7.9 - Editor+ Arbitrary Post Modification via update_media_metadata and approve_media
Published
2022-08-25
Title
Accommodation System <= 1.0.1 - Subscriber+ Unauthorised Actions
Published
2026-09-08
Title
Awesome Support < 6.4.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Denial via 'user_id' Parameter
Published
2024-11-18
Title
Banner System <= 1.0.0 - Privilege Escalation