Vulnerability Description
WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allows unauthenticated attackers to comment on non-public posts by bypassing post status checks. Attackers can attach comments to draft, private, trashed, or password-protected posts to leak hidden titles via moderator notifications, enumerate post IDs, and backdate comments or mark them as pingbacks.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/wp-graphql/wp-graphql
- https://github.com/wp-graphql/wp-graphql/blob/wp-graphql/v2.24.0/plugins/wp-grap
- https://github.com/wp-graphql/wp-graphql/commit/b9da32bd8e6025e19a9b04acaa129978
- https://github.com/wp-graphql/wp-graphql/releases/tag/wp-graphql%2Fv2.24.1
- https://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-4vgv-vvxr-9fh9
- https://www.vulncheck.com/advisories/wpgraphql-before-2.24.1-missing-authorizati
FAQ
What is CVE-2026-119702?
CVE-2026-119702 is a vulnerability with a CVSS score of 6.5 (MEDIUM). WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allows unauthenticated attackers to comment on non-public posts by bypassing post status check...
How severe is CVE-2026-119702?
CVE-2026-119702 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-119702?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.