diff --git a/wp-admin/includes/post.php b/wp-admin/includes/post.php
index 1968e9662e..5fcceec001 100644
--- a/wp-admin/includes/post.php
+++ b/wp-admin/includes/post.php
@@ -1568,7 +1568,7 @@ function _admin_notice_post_locked() {
 		// Allow plugins to prevent some users overriding the post lock
 		if ( $override ) {
 			?>
-			<a class="button button-primary wp-tab-last" href="<?php echo esc_url( add_query_arg( 'get-post-lock', '1', get_edit_post_link( $post->ID, 'url' ) ) ); ?>"><?php _e('Take over'); ?></a>
+			<a class="button button-primary wp-tab-last" href="<?php echo esc_url( add_query_arg( 'get-post-lock', '1', wp_nonce_url( get_edit_post_link( $post->ID, 'url' ), 'lock-post_' . $post->ID ) ) ); ?>"><?php _e('Take over'); ?></a>
 			<?php
 		}
 
diff --git a/wp-admin/post.php b/wp-admin/post.php
index bc71c44b53..89bdc38ce0 100644
--- a/wp-admin/post.php
+++ b/wp-admin/post.php
@@ -165,6 +165,7 @@ case 'edit':
 		wp_die( __( 'You can&#8217;t edit this item because it is in the Trash. Please restore it and try again.' ) );
 
 	if ( ! empty( $_GET['get-post-lock'] ) ) {
+		check_admin_referer( 'lock-post_' . $post_id );
 		wp_set_post_lock( $post_id );
 		wp_redirect( get_edit_post_link( $post_id, 'url' ) );
 		exit();
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 64097ef3dc..cfbae252e5 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -4,7 +4,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '4.3-RC1-33540';
+$wp_version = '4.3-RC1-33542';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.