Wordpress Alert: REST API privilege escalation

A low-privilege account can invoke a REST action reserved for an editor or administrator. The account may gain publishing or administrative powers.

Switchboard Tech Services

Wordpress Alert: REST API privilege escalation

What it looks like

A low-privilege account can invoke a REST action reserved for an editor or administrator.

Why it matters

The account may gain publishing or administrative powers.

What to check

Compare every sensitive route's permission callback with the capability required for the action.

Documentation

This is an exploit pattern to check in installed components, not a claim that every WordPress site has this flaw. Confirm the product and version against its advisories before treating a site as affected. See WordPress REST endpoint permissions, WordPress roles and capabilities.