Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
WordPress core is vulnerable to unauthorized access in versions 6.9 through 6.9.1. The Notes feature (block-level collaboration annotations) was introduced in WordPress 6.9 to allow editorial comments directly on posts in the block editor. However, the REST API `create_item_permissions_check()` method in the comments controller did not verify that the authenticated user has `edit_post` permission on the target post when creating a note. This makes it possible for authenticated attackers with Subscriber-level access to create notes on any post, including posts authored by other users, private posts, and posts in any status.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-03-11 | 1 | General1 |
| 2026-03-15 | 1 | Disclosure1 |
CVE-2026-3906 WordPress Notes Feature Unauthorized Access Vulnerability in Versions 6.9-6.9.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-3906
Post summary
The text announces CVE-2026-3906 as an unauthorized access vulnerability affecting the WordPress Notes feature in versions 6.9–6.9.1, with minimal detail beyond affected versions and a link for more information.
CVE-2026-3906 WordPress core is vulnerable to unauthorized access in versions 6.9 through 6.9.1. The Notes feature (block-level collaboration annotations) was introduced in WordPress… https://www.cve.org/CVERecord?id=CVE-2026-3906
Post summary
The text announces that WordPress core versions 6.9 through 6.9.1 are vulnerable to unauthorized access through the Notes feature, marking a new disclosure but without PoC, exploit details, or patch information.