CVE-2019-20043 Missing authorization in n/a

What is CVE-2019-20043?

CVE-2019-20043 is a medium-severity missing authorization vulnerability in Debian Debian Linux, published on 27 Dec 2019. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in WordPress 3.7 to 5.3.0, authenticated users who do not have the rights to publish a post are able to mark posts as sticky or unsticky via the REST API. For example, the contributor role does not have such rights, but this allowed them to bypass that. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release.

Weakness: CWE-269

Which versions are affected by CVE-2019-20043?

It affects 2 products.

Products include Debian Debian Linux, Wordpress Wordpress.

How do I fix CVE-2019-20043?

Upgrade to a fixed version.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2019-20043 being exploited?

There is no known exploitation of CVE-2019-20043 in the wild and no public exploit code.

Other vulnerabilities in Debian Debian Linux

• CVE-2015-3306 ProFTPD Improper Access Control Exploited Critical 10.0
• CVE-2025-49113 RoundCube Webmail Deserialization of Untrusted Data Exploited Critical 9.9
• CVE-2026-24061 GNU InetUtils Argument Injection Exploited Critical 9.8
• CVE-2025-39682 Linux Kernel Improper Check for Unusual or Exceptional Conditions Exploited Critical 9.8
• CVE-2024-9680 Mozilla Firefox Use-After-Free Exploited Critical 9.8

All Debian Debian Linux vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• GitHub advisory
• How this page is made

Also known as CVE-2019-16788, DEBIAN-CVE-2019-20043, GHSA-g7rg-hchx-c2gw, GHSA-ppxh-5qq2-77g8, UBUNTU-CVE-2019-20043.