CVE-2026-109703
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The WPGraphQL plugin for WordPress has a missing authorization vulnerability that allows retrieving embedded sensitive data. This affects all versions from n/a through 2.23.1.
Risk Assessment
Missing authorization may allow unauthorized users to access sensitive data embedded in graphs, potentially leading to data confidentiality breaches.
Recommendation
Update WPGraphQL to the latest patched version and review access permission configurations.
Other vulnerabilities in WPGraphQL
See all- CVE-2026-88974Medium
The WPGraphQL plugin for WordPress prior to 2.22.2 does not enforce object-level capabilities in the updatePost mutation. An authenticated Contributor can publish their own drafts without editorial approval or modify their own previously published posts despite lacking edit_published_posts.
- CVE-2026-54768Medium
In WPGraphQL for WordPress versions 2.0.0 to 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts and obtain public profile fields.
- CVE-2026-40762High
WPGraphQL versions below 2.11.1 are vulnerable to unauthenticated SQL Injection.
- CVE-2025-68604Medium
A Cross-Site Request Forgery (CSRF) vulnerability in WPGraphQL allows attackers to perform unauthorized actions. This issue affects WPGraphQL from n/a through 2.5.3.
Original NVD description (English source)
Missing Authorization vulnerability in WPGraphQL WPGraphQL wp-graphql allows Retrieve Embedded Sensitive Data.This issue affects WPGraphQL: from n/a through 2.23.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS