CVE-2026-27938

creationtimestamp| type| source ---|---|--- 2026-02-26 05:39:49+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mfqiab7qyg2h 2026-09-05 07:00:03+00:00| seen| Telegram/z32s08izA0c5nX8KIcxgAI90dxl3nICqf5s2ZsFpU7m2f0 2026-09-06 00:00:53+00:00| published-proof-of-concept|...

CVE-2026-27938

WPGraphQL provides a GraphQL API for WordPress sites. Prior to version 2.9.1, the wp-graphql/wp-graphql repository contains a GitHub Actions workflow release.yml vulnerable to OS command injection through direct use of $ github.event.pullrequest.body inside a run: shell block. When a pull request...