CVE-2026-123707

The WPGraphQL WordPress plugin before version 2.27.1 is vulnerable to a content disclosure flaw. The plugin fails to restrict access to posts set to custom non-public post statuses , which allows users with the Contributor role and above to read the content of other users' posts in those statuses...

WPEngine WPGraphQL 0.2.3 - Unauthenticated Comment Posting

The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled. id: CVE-2019-9881 info: name: WPEngine WPGraphQL 0.2.3 - Unauthenticated Comment Posting author: intelligent-ears severity:...

gha-lab-a7f6217d26

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of wp-graphql/wp-graphql at commit...

CVE-2026-92099

CVE-2026-92099 This vulnerability affects the WPGraphQL ecosystem, specifically WPGraphQL Smart Cache and all the version under " + Target Vulnerable! | ... Credits msfire https://github.com/MS-0x404...

WPGraphQL 0.2.3 - User Creation

The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever new user registrations are allowed. This is related to the registerUser mutation. id: CVE-2019-9879 info: name: WPGraphQL 0.2.3 - User Creation author: DhiyaneshDk severity:...

CVE-2026-119699

WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to persist unlimited query documents via the Automatic Persisted Query handler. Attackers can send distinct queries with matching SHA-256 queryId values, including...

CVE-2026-119701

WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to flood password reset emails by aliasing the sendPasswordResetEmail mutation. Attackers can send one HTTP request with many aliases, bypassing batchlimit, to exhaust mail provider quota...

CVE-2026-119700

WPGraphQL before 2.24.2 contains an information disclosure vulnerability that allows unauthenticated attackers to determine object existence through distinct error responses. Attackers can iterate IDs against deleteMediaItem, updateMediaItem, deleteComment and updateComment mutations to discover...

CVE-2026-119702

WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allows unauthenticated attackers to comment on non-public posts by bypassing post status checks. Attackers can attach comments to draft, private, trashed, or password-protected posts to leak...

CVE-2026-119702 WPGraphQL before 2.24.1 Missing Authorization via createComment Mutation

WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allows unauthenticated attackers to comment on non-public posts by bypassing post status checks. Attackers can attach comments to draft, private, trashed, or password-protected posts to leak...

CVE-2026-119702 WPGraphQL before 2.24.1 Missing Authorization via createComment Mutation

WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allows unauthenticated attackers to comment on non-public posts by bypassing post status checks. Attackers can attach comments to draft, private, trashed, or password-protected posts to leak...

CVE-2026-119702

WPGraphQL versions before 2.24.1 are vulnerable to a missing authorization vulnerability within the createComment mutation . This flaw allows unauthenticated attackers to bypass post status checks and attach comments to non-public posts, such as draft , private , trashed , or password-protected c...

EUVD-2026-114107

WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allows unauthenticated attackers to comment on non-public posts by bypassing post status checks. Attackers can attach comments to draft, private, trashed, or password-protected posts to leak...

CVE-2026-119702 WPGraphQL before 2.24.1 Missing Authorization via createComment Mutation

WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allows unauthenticated attackers to comment on non-public posts by bypassing post status checks. Attackers can attach comments to draft, private, trashed, or password-protected posts to leak...

EUVD-2026-114106

WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to flood password reset emails by aliasing the sendPasswordResetEmail mutation. Attackers can send one HTTP request with many aliases, bypassing batchlimit, to exhaust mail provider quota...

CVE-2026-119701 WPGraphQL before 2.24.1 Email Flooding via Aliased sendPasswordResetEmail Mutations

WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to flood password reset emails by aliasing the sendPasswordResetEmail mutation. Attackers can send one HTTP request with many aliases, bypassing batchlimit, to exhaust mail provider quota...

CVE-2026-119701 WPGraphQL before 2.24.1 Email Flooding via Aliased sendPasswordResetEmail Mutations

WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to flood password reset emails by aliasing the sendPasswordResetEmail mutation. Attackers can send one HTTP request with many aliases, bypassing batchlimit, to exhaust mail provider quota...

CVE-2026-119701 WPGraphQL before 2.24.1 Email Flooding via Aliased sendPasswordResetEmail Mutations

WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to flood password reset emails by aliasing the sendPasswordResetEmail mutation. Attackers can send one HTTP request with many aliases, bypassing batchlimit, to exhaust mail provider quota...

CVE-2026-119701

The WPGraphQL plugin (versions prior to 2.24.1 ) is vulnerable to an email flooding attack due to a missing rate limiting flaw. Unauthenticated attackers can exploit the sendPasswordResetEmail mutation by using multiple aliases within a single HTTP request. This technique bypasses the batch_limit...

CVE-2026-119699 WPGraphQL Smart Cache before 2.3.3 Unbounded Persisted Query Storage DoS

WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to persist unlimited query documents via the Automatic Persisted Query handler. Attackers can send distinct queries with matching SHA-256 queryId values, including...