PT-2026-24659 · Wordpress Foundation+3 · Wordpress+1

Kaminuma · Publicado 2026-03-11 · Atualizado 2026-04-28 · CVE-2026-3906

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions WordPress versions 6.9 through 6.9.1

Description WordPress core is susceptible to unauthorized access. The Notes feature, introduced in WordPress 6.9, allows for collaborative annotations on posts within the block editor. However, the REST API create item permissions check() method within the comments controller did not confirm that the authenticated user possesses edit post permission for the specific post when creating a note. This allows authenticated attackers with Subscriber-level access to create notes on any post, including those authored by others, private posts, and posts in any status.

Recommendations Update WordPress to a version beyond 6.9.1.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

BIT-WORDPRESS-2026-3906

BIT-WORDPRESS-MULTISITE-2026-3906

CVE-2026-3906

Produtos afetados

Wordpress

Wordpress-Multisite

Referências · 16

• https://osv.dev/vulnerability/UBUNTU-CVE-2026-3906 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2026-3906 · Aviso do Fabricante
• https://core.trac.wordpress.org/browser/trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php#L562 · Nota
• https://t.me/CVEtracker/47120 · Publicação no Telegram
• https://wordpress.org/news/2026/03/wordpress-6-9-2-release · Nota
• https://ubuntu.com/security/CVE-2026-3906 · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-wordpress-2026-3906 · Aviso do Fabricante
• https://core.trac.wordpress.org/changeset/61888 · Nota
• https://osv.dev/vulnerability/BIT-wordpress-multisite-2026-3906 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2033194304836108492 · Publicação no Twitter
• https://reddit.com/r/StopBadBots/comments/1sxubl0/autoupdate_failed_your_wordpress_is_still_on_692 · Publicação no Reddit
• https://cve.org/CVERecord?id=CVE-2026-3906 · Nota de Segurança
• https://reddit.com/r/Wordpress/comments/1rzvpax/it_seems_like_automatic_wordpress_updates_are · Publicação no Reddit
• https://nvd.nist.gov/vuln/detail/CVE-2026-3906 · Nota de Segurança
• https://wordfence.com/threat-intel/vulnerabilities/id/a69782f0-aa61-4049-8339-7f27f4b6c36b?source=cve · Nota