In WordPress before 4.7.5, there is a lack of capability checks for post meta data in the XML-RPC API.
CVSS Metrics
