From 1f0995ab9526457864d6b4a6d58f7ed10e89b38d Mon Sep 17 00:00:00 2001
From: Ramon <ramonjd@gmail.com>
Date: Thu, 29 Oct 2026 10:45:14 +1100
Subject: [PATCH] Comments: Use the note permission check when deleting
 reactions.

check_edit_permission() sends notes through edit_comment, which
maps to edit_post on the note's post, but did not include
reactions. A reaction now takes the same path as the note it
belongs to. Reactions already cannot be updated, so only
deleting one changes. Regular comments are unaffected.

See #66406.
---
 .../class-wp-rest-comments-controller.php     |  6 +--
 .../rest-api/rest-comments-controller.php     | 38 +++++++++++++++++++
 2 files changed, 41 insertions(+), 3 deletions(-)

diff --git a/src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php b/src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php
index 523ef5e786947..1d035d3a6e1b7 100644
--- a/src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php
+++ b/src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php
@@ -2437,10 +2437,10 @@ protected function check_edit_permission( $comment ) {
 		}
 
 		/*
-		 * Notes are editorial content, so require edit access to the note's post
-		 * rather than the moderate_comments capability.
+		 * Notes and their reactions are editorial content, so require edit access
+		 * to the note's post rather than the moderate_comments capability.
 		 */
-		if ( 'note' === strtolower( $comment->comment_type ) ) {
+		if ( in_array( strtolower( $comment->comment_type ), array( 'note', 'reaction' ), true ) ) {
 			return current_user_can( 'edit_comment', $comment->comment_ID );
 		}
 
diff --git a/tests/phpunit/tests/rest-api/rest-comments-controller.php b/tests/phpunit/tests/rest-api/rest-comments-controller.php
index 687f01a9f50ca..1d9b668c7913e 100644
--- a/tests/phpunit/tests/rest-api/rest-comments-controller.php
+++ b/tests/phpunit/tests/rest-api/rest-comments-controller.php
@@ -5860,6 +5860,44 @@ public function test_delete_reaction_requires_edit_permission() {
 		$this->assertNotNull( get_comment( $reaction_id ) );
 	}
 
+	/**
+	 * A user with moderate_comments but no editing capabilities cannot remove a
+	 * reaction on a post they cannot edit.
+	 *
+	 * @ticket 66406
+	 */
+	public function test_moderator_cannot_delete_reaction() {
+		$post_id     = self::factory()->post->create( array( 'post_author' => self::$editor_id ) );
+		$note_id     = self::factory()->comment->create(
+			array(
+				'comment_post_ID'  => $post_id,
+				'comment_type'     => 'note',
+				'comment_approved' => 0,
+				'user_id'          => self::$editor_id,
+				'comment_content'  => 'Test note',
+			)
+		);
+		$reaction_id = self::factory()->comment->create(
+			array(
+				'comment_post_ID'  => $post_id,
+				'comment_type'     => 'reaction',
+				'comment_parent'   => $note_id,
+				'comment_approved' => 1,
+				'user_id'          => self::$editor_id,
+				'comment_content'  => '2764',
+			)
+		);
+
+		wp_set_current_user( self::$moderator_id );
+
+		$request = new WP_REST_Request( 'DELETE', '/wp/v2/comments/' . $reaction_id );
+		$request->set_param( 'force', true );
+		$response = rest_get_server()->dispatch( $request );
+
+		$this->assertErrorResponse( 'rest_cannot_delete', $response, 403 );
+		$this->assertNotNull( get_comment( $reaction_id ), 'Reaction must still exist.' );
+	}
+
 	/**
 	 * A reaction's author can remove it from a note somebody else wrote.
 	 *