A missing authorization vulnerability allows authenticated users with the Author role to access titles and edit links of private, draft, or otherwise restricted posts via the AJAX query-attachments endpoint. The wp_prepare_attachment_for_js() function did not verify that the current user has permission to read the parent post of an attachment before including the parent post’s title and edit link in the response.
This vulnerability affects the following application versions:
- WordPress 5.6
- WordPress 5.6.1
- WordPress 5.6.2
- WordPress 5.6.3
- WordPress 5.6.4
- WordPress 5.6.5
- WordPress 5.6.6
- WordPress 5.6.7
- WordPress 5.6.8
- WordPress 5.6.9
- WordPress 5.6.10
- WordPress 5.6.11
- WordPress 5.6.12
- WordPress 5.6.13
- WordPress 5.6.14
- WordPress 5.6.15
- WordPress 5.6.16
- WordPress 5.7
- WordPress 5.7.1
- WordPress 5.7.2
- WordPress 5.7.3
- WordPress 5.7.4
- WordPress 5.7.5
- WordPress 5.7.6
- WordPress 5.7.7
- WordPress 5.7.8
- WordPress 5.7.9
- WordPress 5.7.10
- WordPress 5.7.11
- WordPress 5.7.12
- WordPress 5.7.13
- WordPress 5.7.14
- WordPress 5.8
- WordPress 5.8.1
- WordPress 5.8.2
- WordPress 5.8.3
- WordPress 5.8.4
- WordPress 5.8.5
- WordPress 5.8.6
- WordPress 5.8.7
- WordPress 5.8.8
- WordPress 5.8.9
- WordPress 5.8.10
- WordPress 5.8.11
- WordPress 5.8.12
- WordPress 5.9
- WordPress 5.9.1
- WordPress 5.9.2
- WordPress 5.9.3
- WordPress 5.9.4
- WordPress 5.9.5
- WordPress 5.9.6
- WordPress 5.9.7
- WordPress 5.9.8
- WordPress 5.9.9
- WordPress 5.9.10
- WordPress 5.9.11
- WordPress 5.9.12
- WordPress 6.0
- WordPress 6.0.1
- WordPress 6.0.2
- WordPress 6.0.3
- WordPress 6.0.4
- WordPress 6.0.5
- WordPress 6.0.6
- WordPress 6.0.7
- WordPress 6.0.8
- WordPress 6.0.9
- WordPress 6.0.10
- WordPress 6.0.11
- WordPress 6.0.12
- WordPress 6.0.13
- WordPress 6.0.14
- WordPress 6.0.15
- WordPress 6.0.16
- WordPress 6.0.17
- WordPress 6.0.18
- WordPress 6.1
- WordPress 6.1.1
- WordPress 6.1.2
- WordPress 6.1.3
- WordPress 6.1.4
- WordPress 6.1.5
- WordPress 6.1.6
- WordPress 6.1.7
- WordPress 6.1.8
- WordPress 6.1.9
- WordPress 6.2
- WordPress 6.2.1
- WordPress 6.2.2
- WordPress 6.2.3
- WordPress 6.2.4
- WordPress 6.2.5
- WordPress 6.2.6
- WordPress 6.2.7
- WordPress 6.2.8
- WordPress 6.3
- WordPress 6.3.1
- WordPress 6.3.2
- WordPress 6.3.3
- WordPress 6.3.4
- WordPress 6.3.5
- WordPress 6.3.6
- WordPress 6.3.7
- WordPress 6.4
- WordPress 6.4.1
- WordPress 6.4.2
- WordPress 6.4.3
- WordPress 6.4.4
- WordPress 6.4.5
- WordPress 6.4.6
- WordPress 6.4.7
- WordPress 6.5
- WordPress 6.5.2
- WordPress 6.5.3
- WordPress 6.5.4
- WordPress 6.5.5
- WordPress 6.5.6
- WordPress 6.5.7
- WordPress 6.6
- WordPress 6.6.1
- WordPress 6.6.2
- WordPress 6.6.3
- WordPress 6.6.4
- WordPress 6.7
- WordPress 6.7.1
- WordPress 6.7.2
- WordPress 6.7.3
- WordPress 6.7.4
- WordPress 6.8
- WordPress 6.8.1
- WordPress 6.8.2
- WordPress 6.8.3
- WordPress 6.9
- WordPress 6.9.1