Access Control Flaw in WPGraphQL Plugin for WordPress
CVE-2026-123707
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-123707?
The WPGraphQL plugin for WordPress prior to version 2.27.1 features a critical access control flaw that allows users with Contributor roles and above to bypass restrictions on custom non-public post statuses. This means they can unintentionally access and read posts created by other users, potentially leading to unauthorized disclosure of sensitive content.
Affected Version(s)
WPGraphQL 0 < 2.27.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.