CVE-2026-88974
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
The WPGraphQL plugin for WordPress prior to 2.22.2 does not enforce object-level capabilities in the updatePost mutation. An authenticated Contributor can publish their own drafts without editorial approval or modify their own previously published posts despite lacking edit_published_posts.
Risk Assessment
The organization may experience unauthorized publication or modification of content by low-privileged users, bypassing the editorial workflow and content control.
Recommendation
Update the WPGraphQL plugin to version 2.22.2 or later. Until then, consider restricting Contributor roles or auditing posts published by those accounts.
Other vulnerabilities in WPGraphQL
See all- CVE-2026-119702Medium
WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allows unauthenticated attackers to comment on non-public posts by bypassing post status checks. An attacker can attach comments to draft, private, trashed or password-protected posts to leak hidden titles via moderator notifications, enumerate post IDs and backdate comments or mark them as pingbacks.
- CVE-2026-119701Medium
WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to flood password reset emails by aliasing the sendPasswordResetEmail mutation. An attacker can send one HTTP request with many aliases, bypassing batch_limit, to exhaust mail provider quota and repeatedly rotate reset keys, blocking legitimate password recovery.
- CVE-2026-119700Medium
WPGraphQL before 2.24.2 contains an information disclosure vulnerability that allows unauthenticated attackers to determine object existence through distinct error responses. An attacker can iterate IDs against deleteMediaItem, updateMediaItem, deleteComment and updateComment mutations to discover hidden draft, private, trashed posts, custom post types and unapproved comments.
- CVE-2026-109703Medium
The WPGraphQL plugin for WordPress has a missing authorization vulnerability that allows retrieving embedded sensitive data. This affects all versions from n/a through 2.23.1.
- CVE-2026-54768Medium
In WPGraphQL for WordPress versions 2.0.0 to 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts and obtain public profile fields.
- CVE-2026-40762High
WPGraphQL versions below 2.11.1 are vulnerable to unauthenticated SQL Injection.
- CVE-2025-68604Medium
A Cross-Site Request Forgery (CSRF) vulnerability in WPGraphQL allows attackers to perform unauthorized actions. This issue affects WPGraphQL from n/a through 2.5.3.
Original NVD description (English source)
WPGraphQL provides a GraphQL API for WordPress sites. Prior to 2.22.2, the updatePost mutation in src/Mutation/PostObjectUpdate.php checks only the collection-level edit_posts capability and the post author, but does not enforce the object-level edit_post capability or require publish_posts for public status transitions. An authenticated Contributor can therefore publish the Contributor's own draft without editorial approval or modify the Contributor's previously published post despite lacking edit_published_posts, while posts owned by other authors remain protected. This issue is fixed in version 2.22.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS