Information Disclosure of Unpublished Changesets in WordPress Customizer

WordPress 4.9 through 7.1.3 auto-load the most recent unpublished (draft, pending or scheduled) Customizer changeset for a customize-preview request that carries no changeset UUID, without checking the current user's capabilities. An unauthenticated visitor can therefore preview the site rendered with another user's staged, unpublished Customizer... Weiterlesen: Information Disclosure of Unpublished Changesets in WordPress Customizer