Private editorial-note substring oracle through REST pagination totals

Summary

The REST notes collection exposes pagination totals that vary with private editorial-note matches. An unauthorized caller can use the total as a substring oracle for another user’s private note content.

Affected Products

WordPress core 7.0.4; REST Notes collection.

Affected Scope

Product

WordPress

Component

REST Notes controller and collection pagination

Affected function

Notes REST collection; search; page/per_page; X-WP-Total and X-WP-TotalPages

Affected versions

WordPress 7.0.4 (revalidated). Earlier/fixed versions are not asserted without a pinned vendor confirmation.

Safe version

No fixed version confirmed in the supplied material.

CWE

CWE-200; CWE-862

Technical Summary

Pagination metadata acts as an oracle: the count changes when the search term matches a private note that the caller cannot read. The disclosure is through response metadata, not a direct body dump.

Prerequisites and Permissions

Authenticated caller able to reach the Notes REST collection but lacking access to the victim’s private editorial note.

Affected Locations

REST Notes route/controller; WP_Query search/count path; search, page, per_page and response total headers. Exact line numbers are not asserted without the pinned source file.

Reproducible Proof

Two otherwise identical controlled requests using a matching versus non-matching substring returned distinguishable collection totals while direct note access remained denied.

Vulnerable Code

if ( ! $is_head_request ) {
	$comments = array();
	foreach ( $query_result as $comment ) {
		if ( ! $this->check_read_permission( $comment, $request ) ) {
			continue;
		}
		$data = $this->prepare_item_for_response( $comment, $request );
		$comments[] = $this->prepare_response_for_collection( $data );
	}
}
$total_comments = (int) $query->found_comments;
$max_pages = (int) $query->max_num_pages;

Severity

medium

Technical Analysis

The notes REST collection accepts search/pagination inputs and returns X-WP-Total/X-WP-TotalPages derived from the underlying query. The response totals are not normalized to the caller’s effective note-content visibility, so candidate substrings produce distinguishable totals.

Impact

Confidentiality impact: an unauthorized authenticated user can confirm whether guessed strings occur in private editorial notes. The endpoint does not directly return the note body in the demonstrated case; incremental extraction and deployment-specific sensitivity are bounded claims.

Remediation

Ensure collection counts and pagination metadata are computed after the same per-object authorization filter used for returned notes, or suppress totals for unauthorized searches. Add cross-user privacy tests.

Timeline

• 2026-09-15Published
• 2026-09-15Advisory published

Credits

Reported by Aria Akhavan. Disclosure timeline: 2026-08-12 submission; 2026-09-07 follow-up; no response documented by 2026-09-14.