CVE-2016-5835: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: WordPress before 4.5.3 allows remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, related to wp-admin/includes/ajax-actions.php and wp-admin/revision.php.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 7.5
Published: 2016-06-29T14:10Z
Repository: https://github.com/WordPress/WordPress
Language: PHP
Files changed: wp-admin/includes/ajax-actions.php, wp-admin/revision.php, wp-includes/version.php
Commit date: 2016-06-21 14:22:26 +0000
Commit message: Revisions: Change the capability needed to view revision diffs to `edit_post`.
Built from https://develop.svn.wordpress.org/trunk@37779


git-svn-id: http://core.svn.wordpress.org/trunk@37744 1a063a9b-81f0-0310-95a4-ce76da25c4cd

Diff: diff --git a/wp-admin/includes/ajax-actions.php b/wp-admin/includes/ajax-actions.php
index bcd1825332..1864d878ac 100644
--- a/wp-admin/includes/ajax-actions.php
+++ b/wp-admin/includes/ajax-actions.php
@@ -2776,11 +2776,11 @@ function wp_ajax_get_revision_diffs() {
 	require ABSPATH . 'wp-admin/includes/revision.php';
 
 	if ( ! $post = get_post( (int) $_REQUEST['post_id'] ) )
 		wp_send_json_error();
 
-	if ( ! current_user_can( 'read_post', $post->ID ) )
+	if ( ! current_user_can( 'edit_post', $post->ID ) )
 		wp_send_json_error();
 
 	// Really just pre-loading the cache here.
 	if ( ! $revisions = wp_get_post_revisions( $post->ID, array( 'check_enabled' => false ) ) )
 		wp_send_json_error();
diff --git a/wp-admin/revision.php b/wp-admin/revision.php
index 4d86c536b9..d63b26bbf9 100644
--- a/wp-admin/revision.php
+++ b/wp-admin/revision.php
@@ -61,11 +61,11 @@ default :
 	if ( ! $revision = wp_get_post_revision( $revision_id ) )
 		break;
 	if ( ! $post = get_post( $revision->post_parent ) )
 		break;
 
-	if ( ! current_user_can( 'read_post', $revision->ID ) || ! current_user_can( 'read_post', $post->ID ) )
+	if ( ! current_user_can( 'read_post', $revision->ID ) || ! current_user_can( 'edit_post', $revision->post_parent ) )
 		break;
 
 	// Revisions disabled and we're not looking at an autosave
 	if ( ! wp_revisions_enabled( $post ) && ! wp_is_post_autosave( $revision ) ) {
 		$redirect = 'edit.php?post_type=' . $post->post_type;
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 92fdf8d582..78d3fa42f5 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -2,11 +2,11 @@
 /**
  * The WordPress version string
  *
  * @global string $wp_version
  */
-$wp_version = '4.6-alpha-37774';
+$wp_version = '4.6-alpha-37779';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
  *
  * @global int $wp_db_version

Vulnerable code: 	if ( ! current_user_can( 'read_post', $post->ID ) )
	if ( ! current_user_can( 'read_post', $revision->ID ) || ! current_user_can( 'read_post', $post->ID ) )
$wp_version = '4.6-alpha-37774';
Fixed code: 	if ( ! current_user_can( 'edit_post', $post->ID ) )
	if ( ! current_user_can( 'read_post', $revision->ID ) || ! current_user_can( 'edit_post', $revision->post_parent ) )
$wp_version = '4.6-alpha-37779';