WordPress Core is vulnerable to Missing Authorization via the REST comments controller update_item_permissions_check() in various versions up to, and including, 7.1 because the target post is not authorized when a comment or note's parent post is changed - only the current parent was checked. This makes it possible for an authenticated attacker who can edit a comment (e.g. an Author editing a comment on their own post) to reparent it onto an arbitrary post, including posts they can neither read nor edit.