/* Route-Critical (index, V6 §3.6.3 — erzeugt von tools/generate_critical_css.mjs) */ .mydraft-svg-icon{display:inline-block;vertical-align:middle;color:currentcolor;flex-shrink:0;transition:color var(--duration-fast, 150ms) ease,stroke var(--duration-fast, 150ms) ease,fill var(--duration-fast, 150ms) ease}.mydraft-svg-icon circle,.mydraft-svg-icon line,.mydraft-svg-icon path,.mydraft-svg-icon polygon,.mydraft-svg-icon polyline,.mydraft-svg-icon rect{transition:stroke var(--duration-fast, 150ms) ease,fill var(--duration-fast, 150ms) ease}@layer components{.live-pulse-dot{width:8px;height:8px}}@layer overrides{.live-pulse-dot{width:8px;height:8px;background-color:var(--threat-critical,#ef4444);border-radius:50%;display:inline-block;box-shadow:rgba(239,68,68,.7) 0 0 0 0}}@media (prefers-reduced-motion:reduce){@layer overrides{#news-popup,#news-toast-banner,.animate-pulse,.live-pulse-dot,.live-pulsing-dot,.news-item-card{animation:auto ease 0s 1 normal none running none;transition:none}}} 🔒 Incorrect Sticky Post Permission Check in WordPress REST API | Sichere Programmierung – TSECURITY.DE
EILMELDUNGEN LIVE
Malware / Trojaner / VirenCan someone try to crack this crackme?I gave up, it is super small (less then 20 funcs and no tricks like virtualization or obfuscation).Ik I am posting it in wrong community but anyways(18.10.2026 um 11:03 Uhr)
•
AI & KI NachrichtenJulian Goldie SEO: NEW ChatGPT Upgrades Are AMAZING!(18.10.2026 um 10:00 Uhr)
•
IT Security VideoLobby-Chats, Klimadaten und Abschlussprüfungen: Dokumente befreien mit FragDenStaat (jh26congress)(18.10.2026 um 00:00 Uhr)
•
IT Security Toolswifit3 v0.5.0(18.10.2026 um 08:25 Uhr)
•
IT Security NachrichtenMassive Data Breach at Burger King Japan Affects Over 11 Million Customers(18.10.2026 um 10:09 Uhr)
•
Malware / Trojaner / VirenCyberangriffe in Japan: Mehr Datenpannen bei Logistik, Carsharing und Bankenersatz(18.10.2026 um 09:43 Uhr)
•
IT Security NachrichtenConnectWise Cloud-Backup: Angreifer missbrauchen 365-Tenants über Service-Principal(18.10.2026 um 09:44 Uhr)
•
IT Security NachrichtenConnectWise sperrt Cloud-Backup- und Entra-App-Identitäten nach Microsoft-365-Angriff(18.10.2026 um 10:56 Uhr)
•
IT Security NachrichtenSecurity Affairs newsletter Round 600 by Pierluigi Paganini – INTERNATIONAL EDITION(18.10.2026 um 10:37 Uhr)
•
IT Security NachrichtenWeek in review: Hidden implant in Ledger wallets linked to $93M theft, 1,500+ npm packages exposed(18.10.2026 um 10:00 Uhr)
•
Malware / Trojaner / VirenCan someone try to crack this crackme?I gave up, it is super small (less then 20 funcs and no tricks like virtualization or obfuscation).Ik I am posting it in wrong community but anyways(18.10.2026 um 11:03 Uhr)
•
AI & KI NachrichtenJulian Goldie SEO: NEW ChatGPT Upgrades Are AMAZING!(18.10.2026 um 10:00 Uhr)
•
IT Security VideoLobby-Chats, Klimadaten und Abschlussprüfungen: Dokumente befreien mit FragDenStaat (jh26congress)(18.10.2026 um 00:00 Uhr)
•
IT Security Toolswifit3 v0.5.0(18.10.2026 um 08:25 Uhr)
•
IT Security NachrichtenMassive Data Breach at Burger King Japan Affects Over 11 Million Customers(18.10.2026 um 10:09 Uhr)
•
Malware / Trojaner / VirenCyberangriffe in Japan: Mehr Datenpannen bei Logistik, Carsharing und Bankenersatz(18.10.2026 um 09:43 Uhr)
•
IT Security NachrichtenConnectWise Cloud-Backup: Angreifer missbrauchen 365-Tenants über Service-Principal(18.10.2026 um 09:44 Uhr)
•
IT Security NachrichtenConnectWise sperrt Cloud-Backup- und Entra-App-Identitäten nach Microsoft-365-Angriff(18.10.2026 um 10:56 Uhr)
•
IT Security NachrichtenSecurity Affairs newsletter Round 600 by Pierluigi Paganini – INTERNATIONAL EDITION(18.10.2026 um 10:37 Uhr)
•
IT Security NachrichtenWeek in review: Hidden implant in Ledger wallets linked to $93M theft, 1,500+ npm packages exposed(18.10.2026 um 10:00 Uhr)
•
Intelligence View
⚡ tsecurity.de Intelligence

Incorrect Sticky Post Permission Check in WordPress REST API

The REST API posts controller allowed changing a post's sticky status when the user had either the edit_others_posts or publish_posts capability, instead of…

Sichere Programmierung Vulnerability definition feed 1 Min. Lesezeit
Beitrag
0
Seite
0
↗ Quelle (Vulnerability definition feed)
Social ReaktionenReagiere als Erste:r — dein Feedback zählt!

The REST API posts controller allowed changing a post's sticky status when the user had either the edit_others_posts or publish_posts capability, instead of requiring both. Authors could therefore pin their own posts to the top of the front page, an action reserved for Editors and above. This vulnerability affects the following application... Weiterlesen: Incorrect Sticky Post Permission Check in WordPress REST API

🔍 CTI & Forensik

Cyber Threat Intelligence & Forensik

ATT&CK-Navigator · IoC-Radar · Exploit-Belege
CTI Threat Relationship Graph
Akteure · Techniken · Beziehungen
2 Knoten · 1 Relationen
CVE / Incident Threat Actor Software MITRE ATT&CK CWE Weakness IoC
Powered by tsecurity.de tsecurity.de Hub
🚀 Auf tsecurity.de entdecken
Intelligence Digest — kostenlos Täglich die wichtigsten Security-News · jederzeit abbestellbar
Community Rating & Social Proof
⭐ Leser-Wertung
–
Ø / 5.0
Noch keine Leser-Bewertungen
War diese Seite hilfreich?
0
Jetzt Bewertung abgeben
🟢 Niedrig (1-3.9) 🟡 Mittel (4.0-6.9) 🔴 Hoch (7.0-8.9) Kritisch (9.0-10.0)
Powered by tsecurity.de tsecurity.de Hub
🚀 Auf tsecurity.de entdecken

Verwandte Story-Cluster & Quellen (Vektor-KI)

19 Quellen
CVE-2026-111906 | thorsten phpMyFAQ up to 4.1.8/4.2.0-alpha Elasticsearch/OpenSearch Administration API cross-site request forgery (EUVD-2026-103314)
18 weitere Quellen
VulDB Updatesvor 7 Std.CVE-2026-111905 | thorsten phpMyFAQ up to 4.1.8/4.2.0-alpha {userId} userId resource injection (EUVD-2026-103315) VulDB Updatesvor 7 Std.CVE-2026-111904 | thorsten phpMyFAQ 4.2.0-alpha Open Question Controller /api/v4.0/open-questions OpenQuestionController information disclosure (EUVD-2026-103316) VulDB Updatesvor 7 Std.CVE-2026-111903 | thorsten phpMyFAQ 4.2.0-alpha SvgSanitizer cross site scripting (EUVD-2026-103317) VulDB Updatesvor 7 Std.CVE-2026-111894 | thorsten phpMyFAQ up to 4.1.8/4.2.0-alpha cleanUpContent cross site scripting (EUVD-2026-103325) VulDB Updatesvor 7 Std.CVE-2026-111893 | Thorsten phpMyFAQ 4.2.0-alpha GroupController category-restrictions saveCategoryRestrictions categoryIds privileges management (EUVD-2026-103326) VulDB Updatesvor 7 Std.CVE-2026-111892 | thorsten phpMyFAQ up to 4.2.0-alpha.2 Rate Limiting allocation of resources (EUVD-2026-103327)
+12
7 Quellen
CVE-2026-92883 | GitLab up to 19.2.7/19.3.4/19.4.1 HTML Attributes HTML injection (Nessus ID 366859)
6 weitere Quellen
VulDB Updatesvor 4 Std.CVE-2026-85529 | GitLab up to 19.2.7/19.3.4/19.4.1 GraphQL API improper authorization (Nessus ID 366858) VulDB Updatesvor 4 Std.CVE-2026-100755 | GitLab up to 19.2.7/19.3.4/19.4.1 Package Registry privileges management (Nessus ID 366855 / WID-SEC-2026-3858) VulDB Updatesvor 4 Std.CVE-2026-14210 | GitLab up to 19.2.7/19.3.4/19.4.1 Labels improper authorization (Nessus ID 366853) VulDB Updatesvor 5 Std.CVE-2026-92528 | GitLab up to 19.2.7/19.3.4/19.4.1 privileges management (Nessus ID 366866) VulDB Updatesvor 5 Std.CVE-2026-101168 | GitLab up to 19.2.7/19.3.4/19.4.1 Pages information disclosure (Nessus ID 366862 / WID-SEC-2026-3858) VulDB Updatesvor 7 Std.CVE-2026-96893 | GitLab up to 19.2.7/19.3.4/19.4.1 AI Conversation Context Construction neutralization (Nessus ID 366872)

Mehr aus dieser Kategorie

AWS IoT Core: qué es, cómo funciona y cuándo usarlo en tu proyecto
18.10.2026
Shopkeepers won't retype their udhaar khata. KhataLens reads it with Gemma 4, locally
18.10.2026
I let an AI coding agent build a 1,300-page site with a $0 server bill
18.10.2026
ScopeShield: Stop Working for Free — NDA-Safe Scope-Creep Auditor
18.10.2026
Blättern: Pfeiltasten [ ← ] [ → ] · Tasten j / k · mobil: Wischen
Zum Aktualisieren ziehen
TTS Reader • tsecurity.de Voice
Nächster Beitrag