CVE-2026-88974

The WPGraphQL plugin (prior to version 2.22.2 ) contains an authorization bypass in the updatePost mutation within src/Mutation/PostObjectUpdate.php. The root cause is that the mutation only validates the collection-level edit_posts capability and post authorship, failing to enforce object-level ...

CVE-2026-88974: Incorrect Authorization

WPGraphQL provides a GraphQL API for WordPress sites. Prior to 2.22.2, the updatePost mutation in src/Mutation/PostObjectUpdate.php checks only the collection-level editposts capability and the post author, but does not enforce the object-level editpost capability or require publishposts for publ...