Commit dc0a4b2a4f for wordpress.org

commit dc0a4b2a4fa25fda7f5be77b34414e522c362f9b
Author: ramonopoly <ramonopoly@git.wordpress.org>
Date:   Thu Sep 24 05:31:47 2026 +0000

    REST API: Check for a missing post before the comment status capability.

    `WP_REST_Comments_Controller::create_item_permissions_check()` used to check whether the caller was allowed to set the `status` parameter before it checked that a `post` was supplied at all.

    A request that carried a `status` but no `post` was therefore rejected with `rest_comment_invalid_status`, "Sorry, you are not allowed to edit 'status' for comments", which points at the wrong parameter. The actual problem was the missing post.

    This commit moves the missing-post guard above the status capability check. No logic changes.

    Developed in: https://github.com/WordPress/wordpress-develop/pull/12764

    Props ramonopoly, andrewserong, mukesh27.

    Fixes #65761.



    Built from https://develop.svn.wordpress.org/trunk@63912


    git-svn-id: http://core.svn.wordpress.org/trunk@63081 1a063a9b-81f0-0310-95a4-ce76da25c4cd

diff --git a/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php b/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php
index c7a3ffe327..1fa960d584 100644
--- a/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php
+++ b/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php
@@ -568,6 +568,14 @@ class WP_REST_Comments_Controller extends WP_REST_Controller {
 			}
 		}

+		if ( empty( $request['post'] ) ) {
+			return new WP_Error(
+				'rest_comment_invalid_post_id',
+				__( 'Sorry, you are not allowed to create this comment without a post.' ),
+				array( 'status' => 403 )
+			);
+		}
+
 		$edit_cap = $is_note ? array( 'edit_post', (int) $request['post'] ) : array( 'moderate_comments' );
 		if ( isset( $request['status'] ) && ! current_user_can( ...$edit_cap ) ) {
 			return new WP_Error(
@@ -578,14 +586,6 @@ class WP_REST_Comments_Controller extends WP_REST_Controller {
 			);
 		}

-		if ( empty( $request['post'] ) ) {
-			return new WP_Error(
-				'rest_comment_invalid_post_id',
-				__( 'Sorry, you are not allowed to create this comment without a post.' ),
-				array( 'status' => 403 )
-			);
-		}
-
 		/*
 		 * A note's target post was fully checked by check_target_post_permission()
 		 * above. Everything below applies to other comments only: a note is allowed
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 8b9a907189..fc22223180 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -16,7 +16,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '7.2-alpha-63911';
+$wp_version = '7.2-alpha-63912';

 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.