CVE-2026-119702
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allows unauthenticated attackers to comment on non-public posts by bypassing post status checks. An attacker can attach comments to draft, private, trashed or password-protected posts to leak hidden titles via moderator notifications, enumerate post IDs and backdate comments or mark them as pingbacks.
Risk Assessment
An unauthenticated attacker can disclose information about non-public posts and enumerate their IDs, breaching content confidentiality and potentially enabling further attacks.
Recommendation
Upgrade WPGraphQL to 2.24.1 or later and verify that the createComment mutation enforces post status checks.
Other vulnerabilities in WPGraphQL
See all- CVE-2026-119701Medium
WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to flood password reset emails by aliasing the sendPasswordResetEmail mutation. An attacker can send one HTTP request with many aliases, bypassing batch_limit, to exhaust mail provider quota and repeatedly rotate reset keys, blocking legitimate password recovery.
- CVE-2026-119700Medium
WPGraphQL before 2.24.2 contains an information disclosure vulnerability that allows unauthenticated attackers to determine object existence through distinct error responses. An attacker can iterate IDs against deleteMediaItem, updateMediaItem, deleteComment and updateComment mutations to discover hidden draft, private, trashed posts, custom post types and unapproved comments.
- CVE-2026-109703Medium
The WPGraphQL plugin for WordPress has a missing authorization vulnerability that allows retrieving embedded sensitive data. This affects all versions from n/a through 2.23.1.
- CVE-2026-88974Medium
The WPGraphQL plugin for WordPress prior to 2.22.2 does not enforce object-level capabilities in the updatePost mutation. An authenticated Contributor can publish their own drafts without editorial approval or modify their own previously published posts despite lacking edit_published_posts.
- CVE-2026-54768Medium
In WPGraphQL for WordPress versions 2.0.0 to 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts and obtain public profile fields.
- CVE-2026-40762High
WPGraphQL versions below 2.11.1 are vulnerable to unauthenticated SQL Injection.
- CVE-2025-68604Medium
A Cross-Site Request Forgery (CSRF) vulnerability in WPGraphQL allows attackers to perform unauthorized actions. This issue affects WPGraphQL from n/a through 2.5.3.
Original NVD description (English source)
WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allows unauthenticated attackers to comment on non-public posts by bypassing post status checks. Attackers can attach comments to draft, private, trashed, or password-protected posts to leak hidden titles via moderator notifications, enumerate post IDs, and backdate comments or mark them as pingbacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS