CVE-2026-3906: WordPress Core Auth Bypass Vulnerability

CVE-2026-3906 Overview

WordPress core is vulnerable to unauthorized access in versions 6.9 through 6.9.1. The Notes feature (block-level collaboration annotations) was introduced in WordPress 6.9 to allow editorial comments directly on posts in the block editor. However, the REST API create_item_permissions_check() method in the comments controller did not verify that the authenticated user has edit_post permission on the target post when creating a note. This makes it possible for authenticated attackers with Subscriber-level access to create notes on any post, including posts authored by other users, private posts, and posts in any status.

Critical Impact

Authenticated attackers with minimal privileges (Subscriber-level) can create unauthorized notes on any post in the WordPress installation, potentially impacting editorial workflows and content integrity across the entire site.

Affected Products

• WordPress Core 6.9
• WordPress Core 6.9.1
• WordPress installations with the Notes (block-level collaboration) feature enabled

Discovery Timeline

• 2026-03-11 - CVE CVE-2026-3906 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-3906

Vulnerability Analysis

This vulnerability represents a classic Missing Authorization (CWE-862) flaw in the WordPress REST API permissions handling. The Notes feature, introduced in WordPress 6.9 to facilitate editorial collaboration within the block editor, failed to implement proper authorization checks when processing note creation requests.

The core issue lies within the create_item_permissions_check() method in the class-wp-rest-comments-controller.php file. When a user submits a request to create a new note via the REST API, the system verifies that the user is authenticated but fails to confirm whether that user has the necessary edit_post capability on the target post. This oversight allows any authenticated user, even those with the lowest privilege level (Subscriber), to inject notes onto posts they should not have access to modify.

The impact extends beyond simple post annotations—attackers can target private posts, draft content, and posts authored by administrators or editors, potentially disrupting editorial workflows and introducing confusion into collaborative environments.

Root Cause

The root cause is a missing authorization check in the WordPress REST API comments controller. The create_item_permissions_check() method only verifies user authentication status but omits verification of the edit_post capability for the target post. This violates the principle of least privilege by granting note creation capabilities to users who lack editorial permissions on the target content.

Attack Vector

The attack is network-based and requires only low-privilege authenticated access. An attacker with Subscriber-level credentials can exploit this vulnerability by crafting REST API requests to the notes endpoint. Since no user interaction is required and the attack complexity is low, exploitation is straightforward for anyone with basic WordPress authentication.

The attacker simply needs to:

1. Authenticate to WordPress with any valid user account (Subscriber or higher)
2. Identify target post IDs (which can be enumerated via the REST API)
3. Submit POST requests to create notes on arbitrary posts
4. Successfully inject notes on private posts, others' content, or restricted posts

For technical details on the vulnerable code path, refer to the WordPress Comments Controller Code in the WordPress Trac repository.

Detection Methods for CVE-2026-3906

Indicators of Compromise

• Unexpected notes appearing on posts, particularly from users who should not have editorial access
• REST API activity logs showing note creation requests from Subscriber-level accounts
• Notes attached to private posts or drafts from users without the edit_post capability
• Anomalous patterns of note creation across multiple posts by low-privilege users

Detection Strategies

• Monitor WordPress REST API logs for POST requests to note creation endpoints from Subscriber-level accounts
• Implement audit logging for the Notes feature to track note creation events with user capability context
• Review existing notes across posts and verify that note authors have appropriate editorial permissions
• Deploy web application firewall (WAF) rules to detect and alert on suspicious REST API patterns targeting the notes endpoint

Monitoring Recommendations

• Enable detailed logging for WordPress REST API endpoints, particularly those related to comments and notes
• Configure alerts for note creation activity from users without editor-level permissions
• Implement regular audits of user permissions and associated note creation activity
• Consider deploying SentinelOne Singularity for real-time endpoint monitoring to detect unauthorized WordPress activity

How to Mitigate CVE-2026-3906

Immediate Actions Required

• Update WordPress to the patched version that includes the fix from WordPress Changeset #61888
• Review and remove any unauthorized notes that may have been created by low-privilege users
• Audit user accounts with Subscriber-level access for suspicious activity patterns
• Consider temporarily disabling the Notes feature until the patch is applied

Patch Information

WordPress has released a fix via Changeset #61888 which adds proper edit_post capability verification to the create_item_permissions_check() method. The patch ensures that users must have editorial permissions on the target post before they can create notes on it. Apply this update through the WordPress admin dashboard or by downloading the latest WordPress release. For detailed vulnerability analysis, refer to the Wordfence Vulnerability Analysis.

Workarounds

• Disable the Notes feature entirely by removing or deactivating the block-level collaboration annotations functionality
• Restrict REST API access to authenticated users with Editor-level or higher permissions using a security plugin
• Implement custom capability checks via a plugin that enforces edit_post verification for note creation
• Use a web application firewall (WAF) to block REST API requests to note endpoints from low-privilege users

# Configuration example
# Add to wp-config.php to restrict REST API access (temporary mitigation)
# This is a general REST API restriction - adjust based on site requirements
define('DISALLOW_FILE_EDIT', true);

# For more granular control, use a security plugin or custom capability filter
# to enforce edit_post checks on note creation endpoints