From dc7616cf39210d51a0c98471190962a05c520fae Mon Sep 17 00:00:00 2001 From: miyanialkesh7 Date: Thu, 23 Jul 2026 19:58:54 +0530 Subject: [PATCH] Add authorization check on destination post during content import The content-import filter already verified the requesting user could read the source post and validated the nonce, but never checked whether they were allowed to edit the destination post before writing imported content into it. Add an explicit current_user_can( 'edit_post', $dest_post_id ) check alongside the existing checks. --- includes/ContentImport/ContentImporter.php | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/includes/ContentImport/ContentImporter.php b/includes/ContentImport/ContentImporter.php index dbc56e3c..9c38ef5e 100644 --- a/includes/ContentImport/ContentImporter.php +++ b/includes/ContentImport/ContentImporter.php @@ -133,6 +133,10 @@ public function handle_import( array $data = array() ) { return $data; } + if ( ! current_user_can( 'edit_post', $dest_post_id ) ) { + return $data; + } + $import_coordinates = new ImportCoordinates(); $import_coordinates->source_blog_id = $source_blog_id;