CVE-2026-3906: wordpress foundation wordpress Missing Authorization
Vulnerability summary
CVE-2026-3906 is a medium (CVSS 4.3) Missing Authorization vulnerability in wordpress foundation wordpress. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 33.8% of scored vulnerabilities. Fixed in 6.9.2.
Timeline
- 11-03-2026PublishedVulnerability first disclosed.
- 11-03-2026Last modifiedVulnerability information updated.
Description
WordPress core is vulnerable to unauthorized access in versions 6.9 through 6.9.1. The Notes feature (block-level collaboration annotations) was introduced in WordPress 6.9 to allow editorial comments directly on posts in the block editor. However, the REST API `create_item_permissions_check()` method in the comments controller did not verify that the authenticated user has `edit_post` permission on the target post when creating a note. This makes it possible for authenticated attackers with Subscriber-level access to create notes on any post, including posts authored by other users, private posts, and posts in any status.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- OSV · DebianEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- NVDNIST4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- wordfenceSource4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
EPSS trend
Probability
0.41%
Chance of exploitation in the next 30 days
Percentile
34%
Versus all other CVEs
30-day change
+0.10 pp
From 0.30% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- wordpress< 6.9.4+dfsg1-1
Ubuntu1 product
- wordpressAll versions (No fix recorded)
Wordpress1 product
- wordpress≥ 6.9, ≤ 6.9.1 (fixed in 6.9.2)
Wordpress foundation1 product
- wordpress≥ 6.9, ≤ 6.9.1
4 vendors · 4 products
