Changeset 63672

Timestamp:

09/17/2026 05:39:44 PM (11 hours ago)

Author:

adamsilverstein

Message:

Posts, Post Types: Reject a supplied post ID on the create path in _wp_translate_postdata().

Props xknown, westonruter, jorbin, vortfu, batmoo, davidbinda, jeremyfelt.

File:

• trunk/src/wp-admin/includes/post.php (modified) (1 diff)

trunk/src/wp-admin/includes/post.php

@@ -23 +23 @@
         if ( empty( $post_data ) ) {
                 $post_data = &$_POST;
+        }
+
+        /*
+         * A raw `ID` on the create path (no `post_ID`) is an attempt to overwrite an
+         * existing post while bypassing the per-post capability checks below, which only
+         * run on the update path. Reject it outright: legitimate post creation never
+         * carries an `ID`.
+         */
+        if ( ! $update && ! empty( $post_data['ID'] ) ) {
+                if ( 'page' === $post_data['post_type'] ) {
+                        return new WP_Error( 'edit_others_pages', __( 'Sorry, you are not allowed to edit pages as this user.' ) );
+                } else {
+                        return new WP_Error( 'edit_others_posts', __( 'Sorry, you are not allowed to edit posts as this user.' ) );
+                }
         }