Ticket #40854: 40854-no-postid-requirement-in-parse-embed-ajax.2.diff

src/wp-admin/includes/ajax-actions.php

@@ -3005 +3005 @@
 function wp_ajax_parse_embed() {
         global $post, $wp_embed;
 
-        if ( ! $post = get_post( (int) $_POST['post_ID'] ) ) {
-                wp_send_json_error();
-        }
-
-        if ( empty( $_POST['shortcode'] ) || ! current_user_can( 'edit_post', $post->ID ) ) {
+        if ( empty( $_POST['shortcode'] ) || ! current_user_can( 'edit_posts' ) ) {
                 wp_send_json_error();
         }
 
@@ -3026 +3022 @@
         }
 
         $parsed = false;
-        setup_postdata( $post );
+
+        $post_ID = (int) $_POST[ 'post_ID' ];
+        if ( $post_ID && $post = get_post( $post_ID ) ) {
+                if ( ! current_user_can( 'edit_post', $post->ID ) ) {
+                        wp_send_json_error();
+                }
+
+                setup_postdata( $post );
+        }
 
         $wp_embed->return_false_on_fail = true;