CVE-2019-20043

In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in WordPress 3.7 to 5.3.0, authenticated users who do not have the rights to publish a post are able to mark posts as sticky or unsticky via the REST API. For example, the contributor role does not have such rights, but this allowed them to bypass that. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release.

Link	Resource
https://github.com/WordPress/wordpress-develop/commit/1d1d5be7aa94608c04516cac4238e8c22b93c1d9	Third Party Advisory
https://core.trac.wordpress.org/changeset/46893/trunk	Patch
https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-release/	Release Notes Vendor Advisory
https://wpvulndb.com/vulnerabilities/9973	Release Notes Third Party Advisory
https://www.debian.org/security/2020/dsa-4599	Third Party Advisory
https://seclists.org/bugtraq/2020/Jan/8	Mailing List Third Party Advisory
https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-g7rg-hchx-c2gw	Third Party Advisory
https://www.debian.org/security/2020/dsa-4677	Third Party Advisory

Configuration 1

cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

---

Published : 2019-12-27 08:15

Updated : 2023-01-20 04:11

---

NVD link : CVE-2019-20043

Mitre link : CVE-2019-20043

No products.

CWE-269