WordPress Core is vulnerable to Insecure Direct Object Reference via the _wp_translate_postdata() function in various versions up to, and including, 7.1 due to the create path (no post_ID) honoring a raw 'ID' parameter, which wp_insert_post() then treats as an update - bypassing the per-post edit_post capability checks that only run on the update path. This makes it possible for authenticated attackers with Contributor-level access and above to overwrite the content of arbitrary existing posts, including posts authored by higher-privileged users.