https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 19 Oct 2026 03:09:52 +0000 https://cve.radiocsirt.org/vuln/bdu:2020-01953 bdu:2020-01953 https://cve.radiocsirt.org/vuln/bdu:2020-01953 https://cve.radiocsirt.org/vuln/cnvd-2020-03944 cnvd-2020-03944 https://cve.radiocsirt.org/vuln/cnvd-2020-03944 https://cve.radiocsirt.org/vuln/euvd-2026-59760 EUVD-2026-59760 https://cve.radiocsirt.org/vuln/euvd-2026-59760 https://cve.radiocsirt.org/vuln/fkie_cve-2019-20043 <p>In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in WordPress 3.7 to 5.3.0, authenticated users who do not have the rights to publish a post are able to mark posts as sticky or unsticky via the REST API. For example, the contributor role does not have such rights, but this allowed them to bypass that. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release.</p> <p>In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in WordPress 3.7 to 5.3.0, authenticated users who do not have the rights to publish a post are able to mark posts as sticky or unsticky via the REST API. For example, the contributor role does not have such rights, but this allowed them to bypass that. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2019-20043 https://cve.radiocsirt.org/vuln/ghsa-ppxh-5qq2-77g8 <p>WordPress before 5.3.1 allowed an unauthenticated user to make a post sticky through the REST API because of missing access control in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php.</p> <p>WordPress before 5.3.1 allowed an unauthenticated user to make a post sticky through the REST API because of missing access control in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php.</p> https://cve.radiocsirt.org/vuln/ghsa-ppxh-5qq2-77g8 https://cve.radiocsirt.org/vuln/gsd-2019-20043 gsd-2019-20043 https://cve.radiocsirt.org/vuln/gsd-2019-20043 https://cve.radiocsirt.org/vuln/ubuntu-cve-2019-20043 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: wordpress, Ubuntu:18.04:LTS: wordpress</p> <p>In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in WordPress 3.7 to 5.3.0, authenticated users who do not have the rights to publish a post are able to mark posts as sticky or unsticky via the REST API. For example, the contributor role does not have such rights, but this allowed them to bypass that. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: wordpress, Ubuntu:18.04:LTS: wordpress</p> <p>In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in WordPress 3.7 to 5.3.0, authenticated users who do not have the rights to publish a post are able to mark posts as sticky or unsticky via the REST API. For example, the contributor role does not have such rights, but this allowed them to bypass that. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2019-20043