What the vulnerability does
01Description
WordPress core is vulnerable to unauthorized access in versions 6.9 through 6.9.1. The Notes feature (block-level collaboration annotations) was introduced in WordPress 6.9 to allow editorial comments directly on posts in the block editor. However, the REST API `create_item_permissions_check()` method in the comments controller did not verify that the authenticated user has `edit_post` permission on the target post when creating a note. This makes it possible for authenticated attackers with Subscriber-level access to create notes on any post, including posts authored by other users, private posts, and posts in any status.
Explanation of Vulnerability in Simple Terms
02Summary
WordPress 6.9 through 6.9.1 contains an authorization bypass that allows authenticated users to modify content they should not have access to. The vulnerability requires a valid WordPress account but no special privileges. The integrity of site content can be compromised, though data confidentiality and availability are not directly affected.
What an attacker can do
03Attacker Capabilities
Modify or alter WordPress content without proper authorization checks.
Potential impact on your site
04Site Impact
Unauthorized users may alter posts, pages, or other content on your site despite permission restrictions.
Conditions required to exploit
05Prerequisites
Attacker must have a valid WordPress user account with at least low-level privileges.
Key dates
06Disclosure timeline
March 11, 2026
CVE published
March 11, 2026
Record updated
