WordPress core is vulnerable to unauthorized access in versions 6.9 through 6.9.1. The Notes feature (block-level collaboration annotations) was introduced in WordPress 6.9 to allow editorial comments directly on posts in the block editor. However, the REST API `create_item_permissions_check()` method in the comments controller did not verify that the authenticated user has `edit_post` permission on the target post when creating a note. This makes it possible for authenticated attackers with Subscriber-level access to create notes on any post, including posts authored by other users, private posts, and posts in any status.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-675dd9b166 advisory.

    Upstream announcements:

    - [WordPress 6.9.2 Release](https://wordpress.org/news/2026/03/wordpress-6-9-2-release/)
    - [WordPress 6.9.3 and 7.0 beta 4](https://wordpress.org/news/2026/03/wordpress-6-9-3-and-7-0-beta-4/)
    - [WordPress 6.9.4 Release](https://wordpress.org/news/2026/03/wordpress-6-9-4-release/)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-5774d46593 advisory.

    Upstream announcements:

    - [WordPress 6.9.2 Release](https://wordpress.org/news/2026/03/wordpress-6-9-2-release/)
    - [WordPress 6.9.3 and 7.0 beta 4](https://wordpress.org/news/2026/03/wordpress-6-9-3-and-7-0-beta-4/)
    - [WordPress 6.9.4 Release](https://wordpress.org/news/2026/03/wordpress-6-9-4-release/)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-bf984d4931 advisory.

    Upstream announcements:

    - [WordPress 6.9.2 Release](https://wordpress.org/news/2026/03/wordpress-6-9-2-release/)
    - [WordPress 6.9.3 and 7.0 beta 4](https://wordpress.org/news/2026/03/wordpress-6-9-3-and-7-0-beta-4/)
    - [WordPress 6.9.4 Release](https://wordpress.org/news/2026/03/wordpress-6-9-4-release/)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
303247	Fedora 42 : wordpress (2026-675dd9b166)	Nessus	Fedora Local Security Checks	medium
303231	Fedora 43 : wordpress (2026-5774d46593)	Nessus	Fedora Local Security Checks	medium
303230	Fedora 44 : wordpress (2026-bf984d4931)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2026-3906

medium

Tenable Plugins

medium

medium

medium