Missing Authorization Vulnerability in WPGraphQL Plugin
CVE-2026-119702

6.9MEDIUM

Key Information:

Vendor

WPgraphql

Status
WPgraphql
Vendor
CVE Published:
30 October 2026

What is CVE-2026-119702?

The WPGraphQL plugin prior to version 2.24.1 has a missing authorization vulnerability in the createComment mutation. This allows unauthorized users to post comments on non-public posts, including drafts, private, trashed, and password-protected content. Attackers can exploit this vulnerability to disclose hidden post titles through moderator alerts, infer post IDs, and manipulate comments by backdating them or tagging them as pingbacks, potentially leading to further information disclosure.

Affected Version(s)

WPGraphQL 0 < 2.24.1

References

https://github.com/wp-graphql/wp-graphql/security/advisor...
vendor-advisory
https://github.com/wp-graphql/wp-graphql/commit/b9da32bd8...
patch
https://github.com/wp-graphql/wp-graphql/blob/wp-graphql/...
technical-description

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

pnn219
Ryuuzen1011
Zyy0530
.