CVE-2026-3906

Name	CVE-2026-3906
Description	WordPress core is vulnerable to unauthorized access in versions 6.9 through 6.9.1. The Notes feature (block-level collaboration annotations) was introduced in WordPress 6.9 to allow editorial comments directly on posts in the block editor. However, the REST API `create_item_permissions_check()` method in the comments controller did not verify that the authenticated user has `edit_post` permission on the target post when creating a note. This makes it possible for authenticated attackers with Subscriber-level access to create notes on any post, including posts authored by other users, private posts, and posts in any status.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1131148

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
wordpress (PTS)	bullseye	5.7.11+dfsg1-0+deb11u1	fixed
	bullseye (security)	5.7.14+dfsg1-0+deb11u1	fixed
	bookworm, bookworm (security)	6.1.9+dfsg1-0+deb12u1	fixed
	trixie (security), trixie	6.8.3+dfsg1-0+deb13u1	fixed
	forky	6.9+dfsg1-1	vulnerable
	sid	6.9.4+dfsg1-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Debian Bugs
wordpress	source	bullseye	(not affected)
wordpress	source	bookworm	(not affected)
wordpress	source	trixie	(not affected)
wordpress	source	(unstable)	6.9.4+dfsg1-1	1131148

Notes

[trixie] - wordpress <not-affected> (Vulnerable code introduced later)
[bookworm] - wordpress <not-affected> (Vulnerable code introduced later)
[bullseye] - wordpress <not-affected> (Vulnerable code introduced later)
https://core.trac.wordpress.org/changeset/61888
https://wordpress.org/news/2026/03/wordpress-6-9-2-release/