UpHeron
All vulnerabilities

WordPress core

CVE-2019-20043

In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in WordPress 3.7 to 5.3.0, authenticated users who do not have the rights to publish a post are able to mark posts as sticky or unsticky via the REST API. For example, the contributor role does not have such rights, but this allowed them to bypass that. This has been patched in WordPress 5.3.1, along with all the previous…

Severity
Medium 4.3
Published
27 Dec 2019
Last changed
17 Jun 2026
Added to UpHeron
17 Oct 2026
Fixed in
5.3.1
Sources
NVD

Affected software

SoftwareAffected versions
WordPressWordPress core · cpe:a:wordpress:wordpress
  • From 3.7 before 5.3.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2019-20043
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2019-20043