Information Disclosure in WPGraphQL Prior to 2.24.2 by WPGraphQL

CVE-2026-119700

What is CVE-2026-119700?

WPGraphQL versions prior to 2.24.2 are susceptible to an information disclosure vulnerability that allows unauthenticated attackers to infer the existence of certain objects. By exploiting distinct error messages returned from specific mutations, such as deleteMediaItem, updateMediaItem, deleteComment, and updateComment, adversaries can iteratively probe IDs to identify hidden drafts, private posts, trashed entries, custom post types, and unapproved comments. This vulnerability underscores the need for robust access controls and continuous monitoring to safeguard sensitive content.

References