AIKIDO-2026-201909

TL;DR

WordPress core contains eleven independent security flaws across theme installation and preview, custom header images, private parent-post metadata, the HTML API, multisite plugin activation, post updates, REST template handling, comment reparenting, XML-RPC custom CSS changesets, draft and pending post slugs, and paragraph formatting. Depending on the attack path and the caller's privileges, these flaws allow automatic theme installation from a crafted URL, stored cross-site scripting, sensitive information disclosure, path traversal, arbitrary post overwrite, and bypasses of plugin, comment, and custom CSS authorization checks. The unauthenticated wpautop() flaw can store attacker-controlled script through comment paragraph formatting, subject to comment approval. The fix hardens input handling and enforces the missing capability, ownership, and authorization checks across all eleven affected components.