WordPress core: Private parent-post title disclosure in the attachment edit screen (attachment_submitbox_metadata, unfixed sibling of the r61884 read_post fix)

Presentation

WordPress is the open-source content management system that powers a large share of the web. On the attachment edit screen, the “Uploaded to:” box shows the parent post that a media file is attached to.

HDW Sec found that this box renders the parent post’s title with no read_post capability check, so a low-privilege author is served the title (and edit link) of a private or draft post they cannot read whenever their media is attached to it. It is the admin-side twin of the media-modal path that WordPress had just hardened in r61884. WordPress fixed it in the 7.1.1 security release and credited HDWSec.

Issue(s)

• The r61884 fix added a current_user_can( 'read_post', ... ) check to wp_prepare_attachment_for_js() (the media-modal path).
• The admin-side twin attachment_submitbox_metadata() renders the parent post title and its edit link with no equivalent check.
• Any author who owns the attachment reaches this screen and is served the parent post’s title even without read_post on that parent.
• Impact is confidentiality only, a single field, and the parent link is set by a higher-privilege user, so it is a low-severity authorization hardening fix. It crosses the same read_post boundary that r61884 addressed on the sibling code path.

References

• WordPress 7.1.1 security release, 2026-09-17 (credited to HDWSec).
• Incomplete-fix sibling of r61884 (which addressed the media-modal path). No dedicated CVE assigned as of publication.
• Affected code: src/wp-admin/includes/media.php, attachment_submitbox_metadata() (parent-title block).