CVE-2026-3906: 
WordPress vulnerability analysis and mitigation

CVE-2026-3906 is a Missing Authorization vulnerability in WordPress core affecting the Notes (block-level collaboration annotations) feature introduced in WordPress 6.9. The flaw allows authenticated attackers with Subscriber-level access to create notes on any post without proper permission checks, including private posts and posts authored by other users. Affected versions are WordPress 6.9 through 6.9.1; versions beyond 6.9.1 contain the fix. It carries a CVSS v3.1 base score of 4.3 (Medium), assigned by Wordfence and tracked under EUVD-2026-11134 (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a Missing Authorization flaw (CWE-862) combined with Incorrect Privilege Assignment (CWE-266) in the WordPress REST API comments controller. Specifically, the create_item_permissions_check() method in wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php (around line 562) fails to verify that the requesting user holds edit_post capability on the target post before allowing note creation. An attacker with a valid Subscriber-level account can send a crafted REST API request to create a note on any post — including private, draft, or other users' posts — without needing elevated privileges. The relevant code path and patch are documented in the WordPress core Trac changeset (Wordfence, WordPress Trac).

Successful exploitation allows authenticated low-privilege users (Subscriber level) to annotate posts they have no editorial access to, including private posts and posts belonging to other authors. While the primary impact is a low-severity integrity violation (unauthorized note creation), the ability to interact with private or sensitive posts also represents an indirect information disclosure risk — confirming the existence of private content and potentially exposing its context through annotation interactions. Availability is not affected, and there is no direct confidentiality breach beyond the access confirmation risk (Red Hat Bugzilla, Wordfence).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Wordfence). The EPSS score is approximately 0.02%, reflecting a very low probability of exploitation in the near term. The vulnerability requires only Subscriber-level authentication (a low barrier on sites with open registration), but the limited impact scope reduces attacker incentive. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Nessus plugin 302884 is available for detection (Tenable).

1. Reconnaissance: Identify WordPress sites running versions 6.9 or 6.9.1 using HTTP response headers, meta generator tags, or tools like WPScan.
2. Obtain Subscriber-level access: Register a standard user account on the target site (if open registration is enabled) or use existing low-privilege credentials.
3. Identify target post IDs: Enumerate post IDs via the WordPress REST API (e.g., GET /wp-json/wp/v2/posts) or by browsing the site. Private posts may be discoverable by ID guessing.
4. Craft malicious REST API request: Send an authenticated POST request to the notes/comments REST API endpoint, specifying the target post ID and note content, without holding edit_post permission on that post. For example:

   POST /wp-json/wp/v2/comments
   Authorization: Basic <subscriber_credentials>
   Content-Type: application/json
   {"post": <target_post_id>, "content": "<note_content>", "type": "block_comment"}

5. Confirm unauthorized note creation: Verify the note was created on the target post (including private or other users' posts) by checking the API response or the block editor interface (Wordfence, WordPress Trac).

• Network: Unusual authenticated REST API POST requests to /wp-json/wp/v2/comments from low-privilege user accounts, particularly targeting post IDs not associated with the requesting user; requests with type: block_comment or note-type parameters from Subscriber-level accounts.
• Logs: WordPress access logs showing repeated REST API calls to the comments endpoint from the same Subscriber-level user account across multiple post IDs; HTTP 201 responses to note creation requests from accounts without editorial roles.
• Application: Unexpected notes or block-level annotations appearing on private posts, draft posts, or posts authored by other users in the WordPress block editor; notes attributed to Subscriber-level accounts on restricted content.

Update WordPress to any version beyond 6.9.1, which includes the fix applied in core Trac changeset 61888 (WordPress Trac). If immediate patching is not possible, consider restricting REST API access to authenticated users only, disabling open user registration to limit Subscriber-level account creation, or temporarily disabling the Notes/block collaboration feature. Review audit logs for unauthorized note creation activity on private or sensitive posts. Fedora and other Linux distributions have issued updated WordPress packages addressing this issue (Linux Compatible).

The vulnerability was reported by Wordfence and disclosed on March 11, 2026, with Red Hat tracking it via Bugzilla and issuing a security advisory. Pro-Linux.de covered the issue in German-language security bulletins, and SolidWP included it in their WordPress Vulnerability Report for March 18, 2026 (SolidWP, Pro-Linux). Community reaction has been measured given the medium severity and limited exploitation potential.