PT-2026-24659 · Wordpress Foundation+3 · Wordpress+1

Kaminuma · Published 2026-03-11 · Updated 2026-04-28 · CVE-2026-3906

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions WordPress versions 6.9 through 6.9.1

Description WordPress core is susceptible to unauthorized access. The Notes feature, introduced in WordPress 6.9, allows for collaborative annotations on posts within the block editor. However, the REST API create item permissions check() method within the comments controller did not confirm that the authenticated user possesses edit post permission for the specific post when creating a note. This allows authenticated attackers with Subscriber-level access to create notes on any post, including those authored by others, private posts, and posts in any status.

Recommendations Update WordPress to a version beyond 6.9.1.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BIT-WORDPRESS-2026-3906

BIT-WORDPRESS-MULTISITE-2026-3906

CVE-2026-3906

Affected Products

Wordpress

Wordpress-Multisite

References · 16

• https://osv.dev/vulnerability/UBUNTU-CVE-2026-3906 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-3906 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-3906 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-wordpress-2026-3906 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-wordpress-multisite-2026-3906 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-3906 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-3906 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-3906 · Vendor Advisory
• https://core.trac.wordpress.org/browser/trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php#L562 · Note
• https://t.me/CVEtracker/47120 · Telegram Post
• https://wordpress.org/news/2026/03/wordpress-6-9-2-release · Note
• https://core.trac.wordpress.org/changeset/61888 · Note
• https://twitter.com/CVEnew/status/2033194304836108492 · Twitter Post
• https://reddit.com/r/StopBadBots/comments/1sxubl0/autoupdate_failed_your_wordpress_is_still_on_692 · Reddit Post
• https://reddit.com/r/Wordpress/comments/1rzvpax/it_seems_like_automatic_wordpress_updates_are · Reddit Post