[wp-trac] [WordPress Trac] #63856: Bug Report: Post Author Can Be Assigned to Subscribers via Gutenberg Editor

[WordPress Trac]

#63856: Bug Report: Post Author Can Be Assigned to Subscribers via Gutenberg Editor
-------------------------+-------------------------------------------------
 Reporter:  chilu5504    |      Owner:  (none)
     Type:  defect       |     Status:  new
  (bug)                  |
 Priority:  normal       |  Milestone:  Awaiting Review
Component:  Editor       |    Version:  6.8.2
 Severity:  critical     |   Keywords:  has-test-info needs-unit-tests dev-
  Focuses:  tests,       |  feedback
  administration         |
-------------------------+-------------------------------------------------
 Hello WordPress Team,

 Good evening! I regularly use WordPress for both client projects and
 personal work, and while testing the Gutenberg editor, I noticed a bug.

 Normally, when editing a post in Gutenberg, the Author option on the
 right-hand side shows a dropdown with users who have the roles
 Administrator, Editor, or Contributor — but not Subscribers (which is
 correct).

 However, if I inspect the element in the browser and manually change the
 dropdown value to a user ID that belongs to a Subscriber, the post gets
 reassigned to that Subscriber.

 This seems like an issue, because Subscribers should not be selectable as
 post authors into the Editor in admin side.

 I’ve attached screenshots to make this clearer:

 User list: https://prnt.sc/9XIMve4OaJfJ

 Post list (created by Admin): https://prnt.sc/i_uEpCAZnBB8

 Author dropdown in editor: https://prnt.sc/s5Gcu2eGVYSI
 , https://prnt.sc/MzDGzWtO2bRb

 After changing dropdown value to Subscriber user ID:
 https://prnt.sc/VNH1QBIcRjN5

 Subscriber “Chilu” appearing in the list: https://prnt.sc/lOH2a1ZCgFWZ

 Post successfully assigned to Subscriber: https://prnt.sc/Qnnjikk3jevz

 Could you please review this bug? I believe it may allow unintended
 assignment of posts to users with the Subscriber role.

 Thank you for your time and support!

 Best regards,
 Chirag Patel

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/63856>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform