CVE-2019-20043

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in WordPress 3.7 to 5.3.0, authenticated users who do not have the rights to publish a post are able to mark posts as sticky or unsticky via the REST API. For example, the contributor role does not have such rights, but this allowed them to bypass that. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://core.trac.wordpress.org/changeset/46893/trunkPatch
https://github.com/WordPress/wordpress-develop/commit/1d1d5be7aa94608c04516cac4238e8c22b93c1d9Third Party Advisory
https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-g7rg-hchx-c2gwThird Party Advisory
https://seclists.org/bugtraq/2020/Jan/8Mailing List, Third Party Advisory
https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-release/Release Notes, Vendor Advisory
https://wpvulndb.com/vulnerabilities/9973Release Notes, Third Party Advisory
https://www.debian.org/security/2020/dsa-4599Third Party Advisory
https://www.debian.org/security/2020/dsa-4677Third Party Advisory
https://core.trac.wordpress.org/changeset/46893/trunkPatch
https://github.com/WordPress/wordpress-develop/commit/1d1d5be7aa94608c04516cac4238e8c22b93c1d9Third Party Advisory
https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-g7rg-hchx-c2gwThird Party Advisory
https://seclists.org/bugtraq/2020/Jan/8Mailing List, Third Party Advisory
https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-release/Release Notes, Vendor Advisory
https://wpvulndb.com/vulnerabilities/9973Release Notes, Third Party Advisory
https://www.debian.org/security/2020/dsa-4599Third Party Advisory
https://www.debian.org/security/2020/dsa-4677Third Party Advisory

Timeline

Published: Dec 27, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-200447.8In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED option. Zsh fails to overwrite th CVE-2019-200457.5The Synergy Systems & Solutions PLC & RTU system has a vulnerability in HUSKY RTU 6049-E70 firmware versions 5.0 and prior. Specially crafte CVE-2019-200469.8The Synergy Systems & Solutions PLC & RTU system has a vulnerability in HUSKY RTU 6049-E70 firmware versions 5.0 and prior. The affected pro CVE-2019-200477.5An issue was discovered on Alcatel-Lucent OmniVista 4760 devices, and 8770 devices before 4.1.2. An incorrect web server configuration allow CVE-2019-200487.2An issue was discovered on Alcatel-Lucent OmniVista 8770 devices before 4.1.2. An authenticated remote attacker, with elevated privileges in CVE-2019-200499.8An issue was discovered on Alcatel-Lucent OmniVista 4760 devices. A remote unauthenticated attacker can chain a directory traversal (which h CVE-2019-20058.8In onPermissionGrantResult of GrantPermissionsActivity.java, there is a possible incorrectly granted permission due to a missing permission CVE-2019-200506.8Pandora FMS ≤ 7.42 suffers from a remote code execution vulnerability. To exploit the vulnerability, an authenticated user should create a n CVE-2019-200515.5A floating-point exception was discovered in PackLinuxElf::elf_hash in p_lx_elf.cpp in UPX 3.95. The vulnerability causes an application cra CVE-2019-200526.5A memory leak was discovered in Mat_VarCalloc in mat.c in matio 1.5.17 because SafeMulDims does not consider the rank==0 case.CVE-2019-200535.5An invalid memory address dereference was discovered in the canUnpack function in p_mach.cpp in UPX 3.95 via a crafted Mach-O file.CVE-2019-200545.5In the Linux kernel before 5.0.6, there is a NULL pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c, related to put_links,