A missing authorization issue exists on the 'drafts' endpoint. This allows an authenticated user with low privileges to bypass role and permission checks and create draft posts. By using only session authentication, an attacker can send requests to the 'drafts' endpoint to create unauthorized drafts that then appear in the administrative drafts queue.