Privilege Escalation in WordPress XML-RPC Changeset Writes

The XML-RPC methods wp.newPost and wp.editPost accepted any registered post type, including internal-only builtin types such as customize_changeset. Those types are normally written through dedicated helpers that enforce their own capability rules - for customize_changeset, the edit_css / unfiltered_css checks that gate Additional CSS. Writing the... Weiterlesen: Privilege Escalation in WordPress XML-RPC Changeset Writes