AIKIDO-2026-911097

roots/wordpress is vulnerable to Incorrect Authorization

Incorrect Authorization Pre-CVE Published 2 days ago

Medium Risk

This Affects:

roots/wordpress

4.7.16 - 5.6.21

Fixed in 5.6.22

5.7 - 5.7.19

Fixed in 5.7.20

5.8 - 5.8.17

Fixed in 5.8.18

5.9 - 5.9.18

Fixed in 5.9.19

6.0 - 6.0.16

Fixed in 6.0.17

6.1 - 6.1.14

Fixed in 6.1.15

6.2 - 6.2.13

Fixed in 6.2.14

6.3 - 6.3.12

Fixed in 6.3.13

6.4 - 6.4.12

Fixed in 6.4.13

6.5 - 6.5.12

Fixed in 6.5.13

6.6 - 6.6.9

Fixed in 6.6.10

6.7 - 6.7.9

Fixed in 6.7.10

6.8 - 6.8.10

Fixed in 6.8.11

6.9 - 6.9.9

Fixed in 6.9.10

7.0 - 7.0.6

Fixed in 7.0.7

7.1 - 7.1.2

Fixed in 7.1.3

Are you affected? Scan for Free

TL;DR

The posts REST API in roots/wordpress rejects a sticky change only when the caller lacks both edit_others_posts and publish_posts. An Author has publish_posts, so that check accepts the request and the Author can make a post sticky. The fix requires both capabilities before a sticky change is saved.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

roots/wordpress is vulnerable to Incorrect Authorization in versions 4.7.16 - 5.6.21, 5.7 - 5.7.19, 5.8 - 5.8.17, 5.9 - 5.9.18, 6.0 - 6.0.16, 6.1 - 6.1.14, 6.2 - 6.2.13, 6.3 - 6.3.12, 6.4 - 6.4.12, 6.5 - 6.5.12, 6.6 - 6.6.9, 6.7 - 6.7.9, 6.8 - 6.8.10, 6.9 - 6.9.9, 7.0 - 7.0.6 and 7.1 - 7.1.2.