Incorrect Permissions for Notes in WordPress REST Comments Endpoint

The WordPress REST API comments endpoint let any user holding the moderate_comments capability update or delete a note (the block editor's editorial comments, comment type 'note') without checking that they can edit the post the note belongs to. A user whose role can moderate comments but cannot edit a given post could therefore read, change and... Weiterlesen: Incorrect Permissions for Notes in WordPress REST Comments Endpoint