Ticket #19290: 19290.patch

wp-admin/admin-ajax.php

@@ -1479 +1479 @@
         break;
 case 'set-post-thumbnail':
         $post_ID = intval( $_POST['post_id'] );
-        if ( !current_user_can( 'edit_post', $post_ID ) )
+        $post_type = get_post_type( $post_ID );
+        $post_type_object = get_post_type_object( $post_type );
+        if ( !current_user_can( $post_type_object->cap->edit_post, $post_ID ) )
                 die( '-1' );
         $thumbnail_id = intval( $_POST['thumbnail_id'] );