CVE catalog

CVE-2026-3906

Severity: Medium · CVSS 4.3
Published: Mar 10, 2026, 11:00:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.41% · Oct 22, 2026

WordPress core is vulnerable to unauthorized access in versions 6.9 through 6.9.1. The Notes feature (block-level collaboration annotations) was introduced in WordPress 6.9 to allow editorial comments directly on posts in the block editor. However, the REST API `create_item_permissions_check()` method in the comments controller did not verify that the authenticated user has `edit_post` permission on the target post when creating a note. This makes it possible for authenticated attackers with Subscriber-level access to create notes on any post, including posts authored by other users, private posts, and posts in any status.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	wordpress	sid	`7.1.3+dfsg1-1`	fixed
Debian	wordpress	forky	`7.1.3+dfsg1-1`	fixed
Debian	wordpress	trixie	`6.8.7+dfsg1-0+deb13u1`	not affected
Debian	wordpress	trixie-security	`6.8.10+dfsg1-0+deb13u1`	not affected
Debian	wordpress	bookworm	`6.1.9+dfsg1-0+deb12u1`	not affected
Debian	wordpress	bookworm-security	`6.1.9+dfsg1-0+deb12u1`	not affected

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	wordpress	source	sid	`6.9.4+dfsg1-1`	not yet assigned	Not reported	[1131148]
Debian	wordpress	source	forky	`6.9.4+dfsg1-1`	not yet assigned	Not reported	[1131148]
Debian	wordpress	source	trixie	`Not affected`	unimportant	Not reported	[1131148]
Debian	wordpress	source	bookworm	`Not affected`	unimportant	Not reported	[1131148]

[Debian bug #1131148]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[wordpress]Unknown
Details (4)
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm
  Not affected
  nvd · wordpress · debian · bookworm
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm
  Not affected
  nvd · wordpress · debian · bookworm
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm-security
  Not affected
  nvd · wordpress · debian · bookworm
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm-security
  Not affected
  nvd · wordpress · debian · bookworm
[wordpress-l10n]Unknown
Source package: [wordpress]
Details (4)
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm
  Not affected
  nvd · wordpress · debian · bookworm
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm
  Not affected
  nvd · wordpress · debian · bookworm
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm-security
  Not affected
  nvd · wordpress · debian · bookworm
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm-security
  Not affected
  nvd · wordpress · debian · bookworm
[wordpress-theme-twentytwentyone]Unknown
Source package: [wordpress]
Details (4)
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm
  Not affected
  nvd · wordpress · debian · bookworm
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm
  Not affected
  nvd · wordpress · debian · bookworm
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm-security
  Not affected
  nvd · wordpress · debian · bookworm
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm-security
  Not affected
  nvd · wordpress · debian · bookworm
[wordpress-theme-twentytwentythree]Unknown
Source package: [wordpress]
Details (4)
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm
  Not affected
  nvd · wordpress · debian · bookworm
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm
  Not affected
  nvd · wordpress · debian · bookworm
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm-security
  Not affected
  nvd · wordpress · debian · bookworm
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm-security
  Not affected
  nvd · wordpress · debian · bookworm
[wordpress-theme-twentytwentytwo]Unknown
Source package: [wordpress]
Details (4)
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm
  Not affected
  nvd · wordpress · debian · bookworm
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm
  Not affected
  nvd · wordpress · debian · bookworm
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm-security
  Not affected
  nvd · wordpress · debian · bookworm
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm-security
  Not affected
  nvd · wordpress · debian · bookworm

Observed: Oct 24, 2026, 12:37:17 AM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]