The REST API posts controller allowed changing a post's sticky status when the user had either the edit_others_posts or publish_posts capability, instead of requiring both. Authors could therefore pin their own posts to the top of the front page, an action reserved for Editors and above. This vulnerability affects the following application... Weiterlesen: Incorrect Sticky Post Permission Check in WordPress REST API
Intelligence View
⚡ tsecurity.de Intelligence
Incorrect Sticky Post Permission Check in WordPress REST API
The REST API posts controller allowed changing a post's sticky status when the user had either the edit_others_posts or publish_posts capability, instead of…
Cyber Threat Intelligence & Forensik
ATT&CK-Navigator · IoC-Radar · Exploit-Belege
Intelligence Digest — kostenlos Täglich die wichtigsten Security-News · jederzeit abbestellbar