[wp-trac] [WordPress Trac] #65052: Nonce check order flaw in post-quickdraft-save

[WordPress Trac]

#65052: Nonce check order flaw in post-quickdraft-save
--------------------------+-------------------------------------
 Reporter:  rajeshcp      |      Owner:  rajeshcp
     Type:  defect (bug)  |     Status:  assigned
 Priority:  normal        |  Milestone:  Awaiting Review
Component:  Security      |    Version:  trunk
 Severity:  major         |   Keywords:  has-patch needs-testing
  Focuses:                |
--------------------------+-------------------------------------
 $_REQUEST['post_ID'] is used to load a post object before the referer is
 actually checked on line 93. A
   crafted request can cause a database lookup on an arbitrary post_ID
 before authorization. $_REQUEST['_wpnonce'] is
   also accessed without checking key existence.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/65052>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform