Privilege Escalation via Arbitrary Post Overwrite in WordPress

_wp_translate_postdata() applies its per-post capability checks (edit_post / edit_others_posts / edit_published_posts) only on the update path. On the create path it passed the submitted post data straight through, including a caller-supplied ID, and wp_insert_post() treats a supplied ID as the row to write. A Contributor-level user could... Weiterlesen: Privilege Escalation via Arbitrary Post Overwrite in WordPress