Approved comments on unpublished posts disclosed through singular feeds

Summary

Singular comment feeds can include approved comments attached to non-public posts. The feed query does not consistently apply the post visibility boundary before emitting comment content.

Affected Products

WordPress core 7.0.4; comment-feed and singular feed query handling.

Affected Scope

Product

WordPress

Component

Comment feeds / singular feed query

Affected function

WP_Query comment-feed path; comment_post_ID; post_status; comment feed rendering

Affected versions

WordPress 7.0.4 (revalidated). Earlier/fixed versions are not asserted without a pinned vendor confirmation.

Safe version

No fixed version confirmed in the supplied material.

CWE

CWE-200; CWE-862

Technical Summary

Approved comments inherit insufficient visibility from the feed query: the parent post is non-public, but its comments are still selected and serialized for an unauthenticated feed request.

Prerequisites and Permissions

Public access to the site’s comment/singular feed endpoints; a test post with an approved comment and a non-public status.

Affected Locations

wp-includes/class-wp-query.php comment-feed branches; comment_post_ID/post_status visibility checks; singular feed rendering. Exact line numbers depend on the 7.0.4 source snapshot.

Reproducible Proof

A controlled non-public post with an approved marker comment produced that marker in the affected feed while the parent post remained inaccessible anonymously.

Vulnerable Code

$comments = get_approved_comments( $post->ID );
foreach ( $comments as $comment ) {
	echo get_comment_text( $comment );
}

Severity

medium

Technical Analysis

The comment-feed path builds a WP_Query for comments associated with the requested post context. Approved comments on private, draft, or pending posts can survive the comment selection and feed rendering path even though the parent post is not publicly readable.

Impact

Confidentiality impact: unauthenticated visitors can receive comment text and metadata associated with a non-public post. The advisory does not claim disclosure of the post body or private credentials.

Remediation

Require the parent post to be publicly readable before including its comments in public feeds; apply the check in both query construction and final feed serialization; add tests for every non-public status.

Timeline

• 2026-09-15Published
• 2026-09-15Advisory published

Credits

Reported by Aria Akhavan. Disclosure timeline: 2026-08-12 submission; 2026-09-07 follow-up; no response documented by 2026-09-14.