The attachment details screen in wp-admin rendered the title of an attachment’s parent post after checking only that the parent existed, without testing whether the current user was allowed to read it. Any user able to view an attachment therefore learned the title of its parent post, even when that post was private and otherwise inaccessible to them. The fix adds a read_post capability check on the parent post before the “Uploaded to” row is rendered.
This vulnerability affects the following application versions:
- WordPress 5.6
- WordPress 5.6.1
- WordPress 5.6.2
- WordPress 5.6.3
- WordPress 5.6.4
- WordPress 5.6.5
- WordPress 5.6.6
- WordPress 5.6.7
- WordPress 5.6.8
- WordPress 5.6.9
- WordPress 5.6.10
- WordPress 5.6.11
- WordPress 5.6.12
- WordPress 5.6.13
- WordPress 5.6.14
- WordPress 5.6.15
- WordPress 5.6.16
- WordPress 5.6.17
- WordPress 5.6.18
- WordPress 5.6.19
- WordPress 5.7
- WordPress 5.7.1
- WordPress 5.7.2
- WordPress 5.7.3
- WordPress 5.7.4
- WordPress 5.7.5
- WordPress 5.7.6
- WordPress 5.7.7
- WordPress 5.7.8
- WordPress 5.7.9
- WordPress 5.7.10
- WordPress 5.7.11
- WordPress 5.7.12
- WordPress 5.7.13
- WordPress 5.7.14
- WordPress 5.7.15
- WordPress 5.7.16
- WordPress 5.7.17
- WordPress 5.8
- WordPress 5.8.1
- WordPress 5.8.2
- WordPress 5.8.3
- WordPress 5.8.4
- WordPress 5.8.5
- WordPress 5.8.6
- WordPress 5.8.7
- WordPress 5.8.8
- WordPress 5.8.9
- WordPress 5.8.10
- WordPress 5.8.11
- WordPress 5.8.12
- WordPress 5.8.13
- WordPress 5.8.14
- WordPress 5.8.15
- WordPress 5.9
- WordPress 5.9.1
- WordPress 5.9.2
- WordPress 5.9.3
- WordPress 5.9.4
- WordPress 5.9.5
- WordPress 5.9.6
- WordPress 5.9.7
- WordPress 5.9.8
- WordPress 5.9.9
- WordPress 5.9.10
- WordPress 5.9.11
- WordPress 5.9.12
- WordPress 5.9.13
- WordPress 5.9.14
- WordPress 5.9.15
- WordPress 5.9.16
- WordPress 6.0
- WordPress 6.0.1
- WordPress 6.0.2
- WordPress 6.0.3
- WordPress 6.0.4
- WordPress 6.0.5
- WordPress 6.0.6
- WordPress 6.0.7
- WordPress 6.0.8
- WordPress 6.0.9
- WordPress 6.0.10
- WordPress 6.0.11
- WordPress 6.0.12
- WordPress 6.0.13
- WordPress 6.0.14
- WordPress 6.1
- WordPress 6.1.1
- WordPress 6.1.2
- WordPress 6.1.3
- WordPress 6.1.4
- WordPress 6.1.5
- WordPress 6.1.6
- WordPress 6.1.7
- WordPress 6.1.8
- WordPress 6.1.9
- WordPress 6.1.10
- WordPress 6.1.11
- WordPress 6.1.12
- WordPress 6.2
- WordPress 6.2.1
- WordPress 6.2.2
- WordPress 6.2.3
- WordPress 6.2.4
- WordPress 6.2.5
- WordPress 6.2.6
- WordPress 6.2.7
- WordPress 6.2.8
- WordPress 6.2.9
- WordPress 6.2.10
- WordPress 6.2.11
- WordPress 6.3
- WordPress 6.3.1
- WordPress 6.3.2
- WordPress 6.3.3
- WordPress 6.3.4
- WordPress 6.3.5
- WordPress 6.3.6
- WordPress 6.3.7
- WordPress 6.3.8
- WordPress 6.3.9
- WordPress 6.3.10
- WordPress 6.4
- WordPress 6.4.1
- WordPress 6.4.2
- WordPress 6.4.3
- WordPress 6.4.4
- WordPress 6.4.5
- WordPress 6.4.6
- WordPress 6.4.7
- WordPress 6.4.8
- WordPress 6.4.9
- WordPress 6.4.10
- WordPress 6.5
- WordPress 6.5.2
- WordPress 6.5.3
- WordPress 6.5.4
- WordPress 6.5.5
- WordPress 6.5.6
- WordPress 6.5.7
- WordPress 6.5.8
- WordPress 6.5.9
- WordPress 6.5.10
- WordPress 6.6
- WordPress 6.6.1
- WordPress 6.6.2
- WordPress 6.6.3
- WordPress 6.6.4
- WordPress 6.6.5
- WordPress 6.6.6
- WordPress 6.6.7
- WordPress 6.7
- WordPress 6.7.1
- WordPress 6.7.2
- WordPress 6.7.3
- WordPress 6.7.4
- WordPress 6.7.5
- WordPress 6.7.6
- WordPress 6.7.7
- WordPress 6.8
- WordPress 6.8.1
- WordPress 6.8.2
- WordPress 6.8.3
- WordPress 6.8.4
- WordPress 6.8.5
- WordPress 6.8.6
- WordPress 6.8.7
- WordPress 6.8.8
- WordPress 6.9
- WordPress 6.9.1
- WordPress 6.9.2
- WordPress 6.9.3
- WordPress 6.9.4
- WordPress 6.9.5
- WordPress 6.9.6
- WordPress 6.9.7
- WordPress 7.0
- WordPress 7.0.1
- WordPress 7.0.2
- WordPress 7.0.3
- WordPress 7.0.4
- WordPress 7.1