WordPress security changelog
MEDIUM CVE-2026-3906 Deferred

WordPress component: A security weakness

WordPress component is affected by a security weakness. Exploitation requires at least subscriber-level access. The resulting impact depends on how the affected component exposes the vulnerable operation.

CVE / CNA score 4.3 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
WordPress component
Plugin slug
Core
Affected
See vendor advisory
Safe version
See mitigation notes
Published
Mar 11, 2026
Weakness
CWE-862 — Missing Authorization

This CVE was published Mar 11, 2026 and is one of 45 known issues for WordPress core.

Patch or disable the affected component.

Update WordPress component to a release outside the affected range, or disable and remove it until a fixed version is available.

Technical description

WordPress core is vulnerable to unauthorized access in versions 6.9 through 6.9.1. The Notes feature (block-level collaboration annotations) was introduced in WordPress 6.9 to allow editorial comments directly on posts in the block editor. However, the REST API `create_item_permissions_check()` method in the comments controller did not verify that the authenticated user has `edit_post` permission on the target post when creating a note. This makes it possible for authenticated attackers with Subscriber-level access to create notes on any post, including posts authored by other users, private posts, and posts in any status.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary and upstream sources