Vulnerability · Published Mar 11, 2026 · Assigned by Wordfence
CVE-2026-3906WordPress 6.9 - 6.9.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Note Creation via REST API
Medium 4.3
In plain English
A medium-severity missing authorization in WordPress from WordPress Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
WordPress core is vulnerable to unauthorized access in versions 6.9 through 6.9.1. The Notes feature (block-level collaboration annotations) was introduced in WordPress 6.9 to allow editorial comments directly on posts in the block editor. However, the REST API `create_item_permissions_check()` method in the comments controller did not verify that the authenticated user has `edit_post` permission on the target post when creating a note. This makes it possible for authenticated attackers with Subscriber-level access to create notes on any post, including posts authored by other users, private posts, and posts in any status.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:14 | wordpress | 6.9.4+dfsg1-1 | DEBIAN-CVE-2026-3906 |
| Ubuntu:22.04:LTS | wordpress | no fix listed | UBUNTU-CVE-2026-3906 |
| Ubuntu:24.04:LTS | wordpress | no fix listed | UBUNTU-CVE-2026-3906 |
| Ubuntu:25.10 | wordpress | no fix listed | UBUNTU-CVE-2026-3906 |
| Ubuntu:26.04:LTS | wordpress | no fix listed | UBUNTU-CVE-2026-3906 |
| Ubuntu:26.10 | wordpress | no fix listed | UBUNTU-CVE-2026-3906 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| WordPress Foundation | WordPress | 6.9 – through 6.9.1 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N