WPGraphQL 0.2.3 - User Creation

The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever new user registrations are allowed. This is related to the registerUser mutation. id: CVE-2019-9879 info: name: WPGraphQL 0.2.3 - User Creation author: DhiyaneshDk severity:...

WPEngine WPGraphQL 0.2.3 - Unauthenticated Comment Posting

The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled. id: CVE-2019-9881 info: name: WPEngine WPGraphQL 0.2.3 - Unauthenticated Comment Posting author: intelligent-ears severity:...

gha-lab-a7f6217d26

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of wp-graphql/wp-graphql at commit...

CVE-2026-109703

Missing Authorization vulnerability in WPGraphQL WPGraphQL wp-graphql allows Retrieve Embedded Sensitive Data.This issue affects WPGraphQL: from n/a through 2.23.1...

CVE-2026-109703 WordPress WPGraphQL plugin <= 2.23.1 - Sensitive Data Exposure vulnerability

Missing Authorization vulnerability in WPGraphQL WPGraphQL wp-graphql allows Retrieve Embedded Sensitive Data.This issue affects WPGraphQL: from n/a through 2.23.1...

CVE-2026-109703

The WPGraphQL plugin for WordPress (versions up to and including 2.23.1 ) is vulnerable to a Missing Authorization (CWE-862) flaw. This vulnerability allows an unauthenticated attacker to Retrieve Embedded Sensitive Data from the wp-graphql component. The issue results in a Medium severity impact...

WordPress WPGraphQL plugin <= 2.23.1 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Heinrihs Skrodelis in WordPress Plugin WPGraphQL versions = 2.24.2...

CVE-2026-109703: Missing Authorization

Missing Authorization vulnerability in WPGraphQL WPGraphQL wp-graphql allows Retrieve Embedded Sensitive Data.This issue affects WPGraphQL: from n/a through 2.23.1...

CVE-2026-88974

WPGraphQL provides a GraphQL API for WordPress sites. Prior to 2.22.2, the updatePost mutation in src/Mutation/PostObjectUpdate.php checks only the collection-level editposts capability and the post author, but does not enforce the object-level editpost capability or require publishposts for publ...

WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost

Summary WPGraphQL 2.19.0 contains an authorization bypass in the updatePost mutation. An authenticated WordPress Contributor can change one of their own draft posts to PUBLISH despite lacking the publishposts capability. The same mutation also permits the Contributor to modify their own previousl...

GHSA-5MMC-8PC9-WGGG WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost

Summary WPGraphQL 2.19.0 contains an authorization bypass in the updatePost mutation. An authenticated WordPress Contributor can change one of their own draft posts to PUBLISH despite lacking the publishposts capability. The same mutation also permits the Contributor to modify their own previousl...

CVE-2026-88974 WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost

WPGraphQL provides a GraphQL API for WordPress sites. Prior to 2.22.2, the updatePost mutation in src/Mutation/PostObjectUpdate.php checks only the collection-level editposts capability and the post author, but does not enforce the object-level editpost capability or require publishposts for publ...

CVE-2026-88974 WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost

WPGraphQL provides a GraphQL API for WordPress sites. Prior to 2.22.2, the updatePost mutation in src/Mutation/PostObjectUpdate.php checks only the collection-level editposts capability and the post author, but does not enforce the object-level editpost capability or require publishposts for publ...

CVE-2026-88974 WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost

WPGraphQL provides a GraphQL API for WordPress sites. Prior to 2.22.2, the updatePost mutation in src/Mutation/PostObjectUpdate.php checks only the collection-level editposts capability and the post author, but does not enforce the object-level editpost capability or require publishposts for publ...

EUVD-2026-85310

WPGraphQL provides a GraphQL API for WordPress sites. Prior to 2.22.2, the updatePost mutation in src/Mutation/PostObjectUpdate.php checks only the collection-level editposts capability and the post author, but does not enforce the object-level editpost capability or require publishposts for publ...

CVE-2026-88974

The WPGraphQL plugin (prior to version 2.22.2 ) contains an authorization bypass in the updatePost mutation within src/Mutation/PostObjectUpdate.php. The root cause is that the mutation only validates the collection-level edit_posts capability and post authorship, failing to enforce object-level ...

CVE-2026-88974: Incorrect Authorization

WPGraphQL provides a GraphQL API for WordPress sites. Prior to 2.22.2, the updatePost mutation in src/Mutation/PostObjectUpdate.php checks only the collection-level editposts capability and the post author, but does not enforce the object-level editpost capability or require publishposts for publ...

PT-2026-97336

Name of the Vulnerable Software and Affected Versions WPGraphQL versions prior to 2.22.2 Description An authorization bypass exists in the updatePost mutation within src/Mutation/PostObjectUpdate.php. The system only verifies the collection-level edit posts capability and the post author, failing...

WordPress WPGraphQL Smart Cache plugin < 2.3.2 - Unauthenticated Persisted Query Registration and Alias Squatting vulnerability

Unauthenticated Persisted Query Registration and Alias Squatting vulnerability discovered by msfire in WordPress Plugin WPGraphQL Smart Cache versions 2.3.2...

CVE-2026-92099

The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authorisation or validate a caller-supplied query identifier before storing a persisted query from a request, allowing unauthenticated users to publish arbitrary query documents and claim query aliases before a site's own...