Incorrect Sticky Post Permission Check in WordPress REST API

The REST API posts controller allowed changing a post's sticky status when the user had either the edit_others_posts or publish_posts capability, instead of requiring both. Authors could therefore pin their own posts to the top of the front page, an action reserved for Editors and above. This vulnerability affects the following application... Weiterlesen: Incorrect Sticky Post Permission Check in WordPress REST API