Vulnerabilities in wp-graphql
4 resultsCVE-2026-27938HIGHWPGraphQL Repo Vulnerable to Command Injection via Unsanitized GitHub Actions Expression in Release WorkflowEPSS 0.9%CVE-2026-54768MEDIUMWPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)EPSS 0.4%CVE-2026-88974MEDIUMWPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePostEPSS 0.4%CVE-2026-33290MEDIUMWPGraphQL Repo's updateComment allows low-privileged authenticated users to change comment moderation status (comment_approved) without moderate_comments permissionEPSS 0.2%