Contributor creates a live private post through metaWeblog.newPost

Summary

The XML-RPC metaWeblog.newPost implementation accepts a private post status from a Contributor path that does not require publish_posts. This creates a live private post rather than a normal draft.

Affected Products

WordPress core 7.0.4; XML-RPC metaWeblog publishing.

Affected Scope

Product

WordPress

Component

XML-RPC metaWeblog publishing

Affected function

metaWeblog.newPost; post_status; wp_insert_post(); publish_posts capability mapping

Affected versions

WordPress 7.0.4 (revalidated). Earlier/fixed versions are not asserted without a pinned vendor confirmation.

Safe version

No fixed version confirmed in the supplied material.

CWE

CWE-862; CWE-269

Technical Summary

Caller-controlled post_status is accepted through metaWeblog.newPost without a sufficient status-specific capability gate, allowing a Contributor-created private post to be committed as live content.

Prerequisites and Permissions

XML-RPC enabled and authenticated Contributor credentials; no administrator session is required.

Affected Locations

wp-includes/class-wp-xmlrpc-server.php: metaWeblog.newPost(); post_status input; wp_insert_post()/capability mapping.

Reproducible Proof

A controlled Contributor XML-RPC request created a private post visible in the site’s private editorial context, while the same role lacked publish_posts.

Vulnerable Code

$post_id = wp_insert_post(
	array(
		&class="tok-comment">#39;post_titleclass="tok-string">'  => __( 'Auto Draft' ),
		&class="tok-comment">#39;post_type'   => $post_type,
		&class="tok-comment">#39;post_statusclass="tok-string">' => 'auto-draft',
	),
	true,
	false
);

Severity

medium

Technical Analysis

The metaWeblog.newPost handler maps caller-supplied content/status into wp_insert_post() and its capability logic does not consistently reject status=private for a Contributor. The post is stored with private status and becomes a live private object visible to privileged users.

Impact

Integrity impact: a Contributor can create private content in the site’s editorial namespace despite lacking normal publication authority for that status. The issue does not grant access to other users’ content or administrator capabilities.

Remediation

Enforce status-specific capability checks before insertion, especially publish_posts/read_private_posts semantics for private status; add XML-RPC tests for Contributor and Author roles.

Timeline

• 2026-09-15Published
• 2026-09-15Advisory published

Credits

Reported by Aria Akhavan. Disclosure timeline: 2026-08-12 submission; 2026-09-07 follow-up; no response documented by 2026-09-14.