CVE-2026-119700
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
WPGraphQL before 2.24.2 contains an information disclosure vulnerability that allows unauthenticated attackers to determine object existence through distinct error responses. An attacker can iterate IDs against deleteMediaItem, updateMediaItem, deleteComment and updateComment mutations to discover hidden draft, private, trashed posts, custom post types and unapproved comments.
Risk Assessment
An unauthenticated attacker can determine the existence of hidden content and comments, breaching confidentiality and aiding further reconnaissance.
Recommendation
Upgrade WPGraphQL to 2.24.2 or later and normalize error responses so they do not reveal object existence.
Other vulnerabilities in WPGraphQL
See all- CVE-2026-119702Medium
WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allows unauthenticated attackers to comment on non-public posts by bypassing post status checks. An attacker can attach comments to draft, private, trashed or password-protected posts to leak hidden titles via moderator notifications, enumerate post IDs and backdate comments or mark them as pingbacks.
- CVE-2026-119701Medium
WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to flood password reset emails by aliasing the sendPasswordResetEmail mutation. An attacker can send one HTTP request with many aliases, bypassing batch_limit, to exhaust mail provider quota and repeatedly rotate reset keys, blocking legitimate password recovery.
- CVE-2026-109703Medium
The WPGraphQL plugin for WordPress has a missing authorization vulnerability that allows retrieving embedded sensitive data. This affects all versions from n/a through 2.23.1.
- CVE-2026-88974Medium
The WPGraphQL plugin for WordPress prior to 2.22.2 does not enforce object-level capabilities in the updatePost mutation. An authenticated Contributor can publish their own drafts without editorial approval or modify their own previously published posts despite lacking edit_published_posts.
- CVE-2026-54768Medium
In WPGraphQL for WordPress versions 2.0.0 to 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts and obtain public profile fields.
- CVE-2026-40762High
WPGraphQL versions below 2.11.1 are vulnerable to unauthenticated SQL Injection.
- CVE-2025-68604Medium
A Cross-Site Request Forgery (CSRF) vulnerability in WPGraphQL allows attackers to perform unauthorized actions. This issue affects WPGraphQL from n/a through 2.5.3.
Original NVD description (English source)
WPGraphQL before 2.24.2 contains an information disclosure vulnerability that allows unauthenticated attackers to determine object existence through distinct error responses. Attackers can iterate IDs against deleteMediaItem, updateMediaItem, deleteComment and updateComment mutations to discover hidden draft, private, trashed posts, custom post types, and unapproved comments.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS