blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2019-20043

MEDIUM 4.3 CVSS 3.1
Published
December 27, 2019
Last modified
June 17, 2026
NVD status
Modified
Reported by
cve@mitre.org
Weakness
CWE-269
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Description

In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in WordPress 3.7 to 5.3.0, authenticated users who do not have the rights to publish a post are able to mark posts as sticky or unsticky via the REST API. For example, the contributor role does not have such rights, but this allowed them to bypass that. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release.

Affected WordPress components

  • WordPress core
    Confirmed match
    From 3.7 (including) to 5.3.1 (excluding)

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • n/a n/a — Versions not specified
  • wordpress wordpress — From 3.7 (including) to 5.3.1 (excluding)

References

  • core.trac.wordpress.org https://core.trac.wordpress.org/changeset/46893/trunk Patch
  • github.com https://github.com/WordPress/wordpress-develop/commit/1d1d5be7aa94608c04516cac4238e8c22b93c1d9 Third Party Advisory
  • github.com https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-g7rg-hchx-c2gw Third Party Advisory
  • seclists.org https://seclists.org/bugtraq/2020/Jan/8 Mailing List, Third Party Advisory
  • wordpress.org https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-release/ Release Notes, Vendor Advisory
  • wpvulndb.com https://wpvulndb.com/vulnerabilities/9973 Release Notes, Third Party Advisory
  • www.debian.org https://www.debian.org/security/2020/dsa-4599 Third Party Advisory
  • www.debian.org https://www.debian.org/security/2020/dsa-4677 Third Party Advisory
  • nvd.nist.gov Official NVD record