WordPress core versions 6.9 to 6.9.1 contain a missing authorization check in the REST API endpoint used for creating notes. The method `create_item_permissions_check()` does not verify that an authenticated user has the required `edit_post` capability on the target post. Consequently, any authenticated user, including those with only Subscriber privileges, can create notes on any post, regardless of ownership or visibility. The vulnerability is identified as CWE‑862: Missing Authorization.

Any WordPress installation running core versions 6.9 through 6.9.1 is affected. The issue resides in the core code file class‑wp‑rest‑comments‑controller.php and does not require any particular plugin or theme.

The CVSS base score of 4.3 indicates a moderate severity. The EPSS score of less than 1 % suggests a low likelihood of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated and can exploit the flaw over the network via the WordPress REST API by submitting a note creation request.