Ensure unauthorized users don't read post meta

WordPress · Jan 26, 2024 · f53121d · f53121d
1 parent 06a3930
commit f53121d
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/src/wp-includes/block-bindings/sources/post-meta.php b/src/wp-includes/block-bindings/sources/post-meta.php
@@ -14,6 +14,13 @@ function post_meta_source_callback( $source_attrs ) {
 		$post_id = get_the_ID();
 	}
 
+	// If a post isn't public, we need to prevent
+	// unauthorized users from accessing the post meta.
+	$post = get_post($post_id);
+	if ( ( $post && $post->post_status != 'publish' && ! current_user_can( 'read_post', $post_id ) ) || post_password_required( $post_id ) ) {
+		return null;
+	}
+
 	return get_post_meta( $post_id, $source_attrs['value'], true );
 }