Disclosure of private notes in comment feeds

Comment feeds selected every approved row from the comments table without filtering on comment type, so internal notes (comment_type of note), which are not intended to be publicly visible, were published in the archive, search, front-page and single-post comment feeds. The fix adds AND {$wpdb->comments}.comment_type != ‘note’ to all three $cwhere clauses in WP_Query::get_posts() and WP_Query::the_comments().

This vulnerability affects the following application versions:

• WordPress 4.7
• WordPress 4.7.1
• WordPress 4.7.2
• WordPress 4.7.3
• WordPress 4.7.4
• WordPress 4.7.5
• WordPress 4.7.6
• WordPress 4.7.7
• WordPress 4.7.8
• WordPress 4.7.9
• WordPress 4.7.10
• WordPress 4.7.11
• WordPress 4.7.12
• WordPress 4.7.13
• WordPress 4.7.14
• WordPress 4.7.15
• WordPress 4.7.16
• WordPress 4.7.17
• WordPress 4.7.18
• WordPress 4.7.19
• WordPress 4.7.20
• WordPress 4.7.21
• WordPress 4.7.22
• WordPress 4.7.23
• WordPress 4.7.24
• WordPress 4.7.25
• WordPress 4.7.26
• WordPress 4.7.27
• WordPress 4.7.28
• WordPress 4.7.29
• WordPress 4.7.30
• WordPress 4.7.31
• WordPress 4.7.32
• WordPress 4.7.33
• WordPress 4.7.34
• WordPress 4.7.35
• WordPress 4.8
• WordPress 4.8.1
• WordPress 4.8.2
• WordPress 4.8.3
• WordPress 4.8.4
• WordPress 4.8.5
• WordPress 4.8.6
• WordPress 4.8.7
• WordPress 4.8.8
• WordPress 4.8.9
• WordPress 4.8.10
• WordPress 4.8.11
• WordPress 4.8.12
• WordPress 4.8.13
• WordPress 4.8.14
• WordPress 4.8.15
• WordPress 4.8.16
• WordPress 4.8.17
• WordPress 4.8.18
• WordPress 4.8.19
• WordPress 4.8.20
• WordPress 4.8.21
• WordPress 4.8.22
• WordPress 4.8.23
• WordPress 4.8.24
• WordPress 4.8.25
• WordPress 4.8.26
• WordPress 4.8.27
• WordPress 4.8.28
• WordPress 4.8.29
• WordPress 4.8.30
• WordPress 4.9
• WordPress 4.9.1
• WordPress 4.9.2
• WordPress 4.9.3
• WordPress 4.9.4
• WordPress 4.9.5
• WordPress 4.9.6
• WordPress 4.9.7
• WordPress 4.9.8
• WordPress 4.9.9
• WordPress 4.9.10
• WordPress 4.9.11
• WordPress 4.9.12
• WordPress 4.9.13
• WordPress 4.9.14
• WordPress 4.9.15
• WordPress 4.9.16
• WordPress 4.9.17
• WordPress 4.9.18
• WordPress 4.9.19
• WordPress 4.9.20
• WordPress 4.9.21
• WordPress 4.9.22
• WordPress 4.9.23
• WordPress 4.9.24
• WordPress 4.9.25
• WordPress 4.9.26
• WordPress 4.9.27
• WordPress 4.9.28
• WordPress 4.9.29
• WordPress 4.9.30
• WordPress 4.9.31
• WordPress 5.0
• WordPress 5.0.1
• WordPress 5.0.10
• WordPress 5.0.11
• WordPress 5.0.12
• WordPress 5.0.13
• WordPress 5.0.14
• WordPress 5.0.15
• WordPress 5.0.16
• WordPress 5.0.2
• WordPress 5.0.3
• WordPress 5.0.4
• WordPress 5.0.6
• WordPress 5.0.7
• WordPress 5.0.8
• WordPress 5.0.9
• WordPress 5.0.17
• WordPress 5.0.18
• WordPress 5.0.19
• WordPress 5.0.20
• WordPress 5.0.21
• WordPress 5.0.22
• WordPress 5.0.23
• WordPress 5.0.24
• WordPress 5.0.25
• WordPress 5.0.26
• WordPress 5.0.27
• WordPress 5.0 Beta 1
• WordPress 5.0 Beta 2
• WordPress 5.0 Beta 3
• WordPress 5.0 Beta 4
• WordPress 5.0 RC1
• WordPress 5.0 RC2
• WordPress 5.0 RC3
• WordPress 5.1
• WordPress 5.1.1
• WordPress 5.1.10
• WordPress 5.1.11
• WordPress 5.1.12
• WordPress 5.1.13
• WordPress 5.1.14
• WordPress 5.1.15
• WordPress 5.1.16
• WordPress 5.1.17
• WordPress 5.1.18
• WordPress 5.1.19
• WordPress 5.1.2
• WordPress 5.1.20
• WordPress 5.1.21
• WordPress 5.1.22
• WordPress 5.1.23
• WordPress 5.1.24
• WordPress 5.1.3
• WordPress 5.1.4
• WordPress 5.1.5
• WordPress 5.1.6
• WordPress 5.1.7
• WordPress 5.1.8
• WordPress 5.1.9
• WordPress 5.2
• WordPress 5.2.1
• WordPress 5.2.10
• WordPress 5.2.11
• WordPress 5.2.12
• WordPress 5.2.13
• WordPress 5.2.14
• WordPress 5.2.15
• WordPress 5.2.16
• WordPress 5.2.17
• WordPress 5.2.18
• WordPress 5.2.19
• WordPress 5.2.2
• WordPress 5.2.20
• WordPress 5.2.21
• WordPress 5.2.22
• WordPress 5.2.23
• WordPress 5.2.24
• WordPress 5.2.25
• WordPress 5.2.26
• WordPress 5.2.3
• WordPress 5.2.4
• WordPress 5.2.5
• WordPress 5.2.6
• WordPress 5.2.7
• WordPress 5.2.8
• WordPress 5.2.9
• WordPress 5.2 Beta 1
• WordPress 5.2 Beta 2
• WordPress 5.3
• WordPress 5.3.1
• WordPress 5.3.10
• WordPress 5.3.11
• WordPress 5.3.12
• WordPress 5.3.13
• WordPress 5.3.14
• WordPress 5.3.15
• WordPress 5.3.16
• WordPress 5.3.17
• WordPress 5.3.18
• WordPress 5.3.19
• WordPress 5.3.2
• WordPress 5.3.20
• WordPress 5.3.21
• WordPress 5.3.22
• WordPress 5.3.23
• WordPress 5.3.3
• WordPress 5.3.4
• WordPress 5.3.5
• WordPress 5.3.6
• WordPress 5.3.7
• WordPress 5.3.8
• WordPress 5.3.9
• WordPress 5.4
• WordPress 5.4.1
• WordPress 5.4.10
• WordPress 5.4.11
• WordPress 5.4.12
• WordPress 5.4.13
• WordPress 5.4.14
• WordPress 5.4.15
• WordPress 5.4.16
• WordPress 5.4.17
• WordPress 5.4.18
• WordPress 5.4.19
• WordPress 5.4.2
• WordPress 5.4.20
• WordPress 5.4.21
• WordPress 5.4.3
• WordPress 5.4.4
• WordPress 5.4.5
• WordPress 5.4.6
• WordPress 5.4.7
• WordPress 5.4.8
• WordPress 5.4.9
• WordPress 5.5
• WordPress 5.5.1
• WordPress 5.5.10
• WordPress 5.5.11
• WordPress 5.5.12
• WordPress 5.5.13
• WordPress 5.5.14
• WordPress 5.5.15
• WordPress 5.5.16
• WordPress 5.5.17
• WordPress 5.5.18
• WordPress 5.5.19
• WordPress 5.5.2
• WordPress 5.5.20
• WordPress 5.5.3
• WordPress 5.5.4
• WordPress 5.5.5
• WordPress 5.5.6
• WordPress 5.5.7
• WordPress 5.5.8
• WordPress 5.5.9
• WordPress 5.6
• WordPress 5.6.1
• WordPress 5.6.10
• WordPress 5.6.11
• WordPress 5.6.12
• WordPress 5.6.13
• WordPress 5.6.14
• WordPress 5.6.15
• WordPress 5.6.16
• WordPress 5.6.17
• WordPress 5.6.18
• WordPress 5.6.19
• WordPress 5.6.2
• WordPress 5.6.3
• WordPress 5.6.4
• WordPress 5.6.5
• WordPress 5.6.6
• WordPress 5.6.7
• WordPress 5.6.8
• WordPress 5.6.9
• WordPress 5.7
• WordPress 5.7.1
• WordPress 5.7.10
• WordPress 5.7.11
• WordPress 5.7.12
• WordPress 5.7.13
• WordPress 5.7.14
• WordPress 5.7.15
• WordPress 5.7.16
• WordPress 5.7.17
• WordPress 5.7.2
• WordPress 5.7.3
• WordPress 5.7.4
• WordPress 5.7.5
• WordPress 5.7.6
• WordPress 5.7.7
• WordPress 5.7.8
• WordPress 5.7.9
• WordPress 5.8
• WordPress 5.8.1
• WordPress 5.8.10
• WordPress 5.8.11
• WordPress 5.8.12
• WordPress 5.8.13
• WordPress 5.8.14
• WordPress 5.8.15
• WordPress 5.8.2
• WordPress 5.8.3
• WordPress 5.8.4
• WordPress 5.8.5
• WordPress 5.8.6
• WordPress 5.8.7
• WordPress 5.8.8
• WordPress 5.8.9
• WordPress 5.9
• WordPress 5.9.1
• WordPress 5.9.10
• WordPress 5.9.11
• WordPress 5.9.12
• WordPress 5.9.13
• WordPress 5.9.14
• WordPress 5.9.15
• WordPress 5.9.16
• WordPress 5.9.2
• WordPress 5.9.3
• WordPress 5.9.4
• WordPress 5.9.5
• WordPress 5.9.6
• WordPress 5.9.7
• WordPress 5.9.8
• WordPress 5.9.9
• WordPress 6.0
• WordPress 6.0.1
• WordPress 6.0.10
• WordPress 6.0.11
• WordPress 6.0.12
• WordPress 6.0.13
• WordPress 6.0.14
• WordPress 6.0.2
• WordPress 6.0.3
• WordPress 6.0.4
• WordPress 6.0.5
• WordPress 6.0.6
• WordPress 6.0.7
• WordPress 6.0.8
• WordPress 6.0.9
• WordPress 6.1
• WordPress 6.1.1
• WordPress 6.1.10
• WordPress 6.1.11
• WordPress 6.1.12
• WordPress 6.1.2
• WordPress 6.1.3
• WordPress 6.1.4
• WordPress 6.1.5
• WordPress 6.1.6
• WordPress 6.1.7
• WordPress 6.1.8
• WordPress 6.1.9
• WordPress 6.2
• WordPress 6.2.1
• WordPress 6.2.10
• WordPress 6.2.11
• WordPress 6.2.2
• WordPress 6.2.3
• WordPress 6.2.4
• WordPress 6.2.5
• WordPress 6.2.6
• WordPress 6.2.7
• WordPress 6.2.8
• WordPress 6.2.9
• WordPress 6.3
• WordPress 6.3.1
• WordPress 6.3.10
• WordPress 6.3.2
• WordPress 6.3.3
• WordPress 6.3.4
• WordPress 6.3.5
• WordPress 6.3.6
• WordPress 6.3.7
• WordPress 6.3.8
• WordPress 6.3.9
• WordPress 6.4
• WordPress 6.4.1
• WordPress 6.4.10
• WordPress 6.4.2
• WordPress 6.4.3
• WordPress 6.4.4
• WordPress 6.4.5
• WordPress 6.4.6
• WordPress 6.4.7
• WordPress 6.4.8
• WordPress 6.4.9
• WordPress 6.5
• WordPress 6.5.10
• WordPress 6.5.2
• WordPress 6.5.3
• WordPress 6.5.4
• WordPress 6.5.5
• WordPress 6.5.6
• WordPress 6.5.7
• WordPress 6.5.8
• WordPress 6.5.9
• WordPress 6.6
• WordPress 6.6.1
• WordPress 6.6.2
• WordPress 6.6.3
• WordPress 6.6.4
• WordPress 6.6.5
• WordPress 6.6.6
• WordPress 6.6.7
• WordPress 6.7
• WordPress 6.7.1
• WordPress 6.7.2
• WordPress 6.7.3
• WordPress 6.7.4
• WordPress 6.7.5
• WordPress 6.7.6
• WordPress 6.7.7
• WordPress 6.8
• WordPress 6.8.1
• WordPress 6.8.2
• WordPress 6.8.3
• WordPress 6.8.4
• WordPress 6.8.5
• WordPress 6.8.6
• WordPress 6.8.7
• WordPress 6.8.8
• WordPress 6.9
• WordPress 6.9.1
• WordPress 6.9.2
• WordPress 6.9.3
• WordPress 6.9.4
• WordPress 6.9.5
• WordPress 7.0
• WordPress 7.0.1
• WordPress 7.0.2