CVE-2026-3906

WordPress core is vulnerable to unauthorized access in versions 6.9 through 6.9.1. The Notes feature (block-level collaboration annotations) was introduced in WordPress 6.9 to allow editorial comments directly on posts in the block editor. However, the REST API `create_item_permissions_check()` method in the comments controller did not verify that the authenticated user has `edit_post` permission on the target post when creating a note. This makes it possible for authenticated attackers with Subscriber-level access to create notes on any post, including posts authored by other users, private posts, and posts in any status.

• CWE-862

• https://core.trac.wordpress.org/browser/trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php#L562
• https://core.trac.wordpress.org/changeset/61888
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a69782f0-aa61-4049-8339-7f27f4b6c36b?source=cve

Published

Mar 11, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-3904Calling NSS-backed functions that support caching via nscd m…6.2
• CVE-2026-39042An issue in MikroTIk (SIA Mikrotikls, Latvia) RouterOS 7.21.…7.5
• CVE-2026-39047Buffer Overflow vulnerability in EPSON L14150 FL27PB allows …7.5
• CVE-2026-39052Oinone Pamirs 7.0.0 contains a code execution vulnerability …6.5
• CVE-2026-39053Oinone Pamirs 7.0.0 contains an XML External Entity (XXE) is…6.5
• CVE-2026-39054Oinone Pamirs 7.0.0 contains a command injection vulnerabili…7.3
• CVE-2026-3907The Hostel plugin for WordPress is vulnerable to Stored Cros…6.4
• CVE-2026-39079An issue in prestashop upsshipping all versions through at l…7.5
• CVE-2026-39087ntfy before 2.22.0 allows SSRF because of an unanchored regu…6.4
• CVE-2026-3909Out of bounds write in Skia in Google Chrome prior to 146.0.…8.8
• CVE-2026-3910Inappropriate implementation in V8 in Google Chrome prior to…8.8
• CVE-2026-39103Buffer Overflow vulnerability in GPAC before commit v391dc7f…5.5