ZeroDay Findings
Sign inSign up

Findings

CVE-2026-3906

WordPress core is vulnerable to unauthorized access in versions 6.9 through 6.9.1.

Published Mar 11, 2026 · updated Jun 17, 2026

WordPress core is vulnerable to unauthorized access in versions 6.9 through 6.9.1. The Notes feature (block-level collaboration annotations) was introduced in WordPress 6.9 to allow editorial comments directly on posts in the block editor. However, the REST API method in the comments controller did not verify that the authenticated user has permission on the target post when creating a note. This makes it possible for authenticated attackers with Subscriber-level access to create notes on any post, including posts authored by other users, private posts, and posts in any status.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 11, 2026 · NIST NVD

    Detected

    WordPress core is vulnerable to unauthorized access in versions 6.9 through 6.9.1. The Notes feature (block-level collaboration annotations) was introduced in WordPress 6.9 to allow editorial comments directly on posts in the block editor. However, the REST API method in the comments controller did not verify that the authenticated user has permission on the target post when creating a note. This

  2. Jun 17, 2026 · NIST NVD

    Updated

    WordPress core is vulnerable to unauthorized access in versions 6.9 through 6.9.1. The Notes feature (block-level collaboration annotations) was introduced in WordPress 6.9 to allow editorial comments directly on posts in the block editor. However, the REST API method in the comments controller did not verify that the authenticated user has permission on the target post when creating a note. This

Sources

  • CVE.orgVulnerability recordCVE-2026-3906

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-3906

    WordPress core is vulnerable to unauthorized access in versions 6.9 through 6.9.1. The Notes feature (block-level collaboration annotations) was introduced in WordPress 6.9 to allow editorial comments directly on posts in the block editor. However, the REST API `create_item_permi

    nvd.nist.gov

References