[wp-trac] [WordPress Trac] #65052: Nonce check order flaw in post-quickdraft-save

[WordPress Trac]

#65052: Nonce check order flaw in post-quickdraft-save
-------------------------------------+------------------------------
 Reporter:  rajeshcp                 |       Owner:  rajeshcp
     Type:  defect (bug)             |      Status:  assigned
 Priority:  normal                   |   Milestone:  Awaiting Review
Component:  Security                 |     Version:  trunk
 Severity:  normal                   |  Resolution:
 Keywords:  has-patch needs-testing  |     Focuses:
-------------------------------------+------------------------------
Changes (by westonruter):

 * severity:  major => normal


Comment:

 > A crafted request can cause a database lookup on an arbitrary post_ID
 before authorization.

 This is not a security issue. Enumerating post IDs can be done with the
 REST API.

 If it were a security issue, especially a major one, it should //not// be
 reported in Trac but rather in the [https://hackerone.com/wordpress
 WordPress HackerOne].

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/65052#comment:3>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform