Commit 46392a4fb5 for wordpress.org

commit 46392a4fb5bbc69ff70d54f0938d4702b51eebda
Author: adamsilverstein <adamsilverstein@git.wordpress.org>
Date:   Thu Sep 17 17:42:28 2026 +0000

    Posts, Post Types: Reject a supplied post ID on the create path in `_wp_translate_postdata()`.

    Props xknown, westonruter, jorbin, vortfu, batmoo, davidbinda, jeremyfelt.


    Built from https://develop.svn.wordpress.org/trunk@63672


    git-svn-id: http://core.svn.wordpress.org/trunk@62846 1a063a9b-81f0-0310-95a4-ce76da25c4cd

diff --git a/wp-admin/includes/post.php b/wp-admin/includes/post.php
index 40a51e6394..c391353169 100644
--- a/wp-admin/includes/post.php
+++ b/wp-admin/includes/post.php
@@ -24,6 +24,20 @@ function _wp_translate_postdata( $update = false, $post_data = null ) {
 		$post_data = &$_POST;
 	}

+	/*
+	 * A raw `ID` on the create path (no `post_ID`) is an attempt to overwrite an
+	 * existing post while bypassing the per-post capability checks below, which only
+	 * run on the update path. Reject it outright: legitimate post creation never
+	 * carries an `ID`.
+	 */
+	if ( ! $update && ! empty( $post_data['ID'] ) ) {
+		if ( 'page' === $post_data['post_type'] ) {
+			return new WP_Error( 'edit_others_pages', __( 'Sorry, you are not allowed to edit pages as this user.' ) );
+		} else {
+			return new WP_Error( 'edit_others_posts', __( 'Sorry, you are not allowed to edit posts as this user.' ) );
+		}
+	}
+
 	if ( $update ) {
 		$post_data['ID'] = (int) $post_data['post_ID'];
 	}
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 0797727aa0..2995bd0538 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -16,7 +16,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '7.2-alpha-63670';
+$wp_version = '7.2-alpha-63672';

 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.