CVE-2026-119700mediumCWE-204

CVE-2026-119700: falha de média gravidade em WPGraphQL

WPGraphQL before 2.24.2 Object Existence Disclosure via Media and Comment Mutations

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar WPGraphQL

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.9epss 0.4%
WPGraphQL before 2.24.2 contains an information disclosure vulnerability that allows unauthenticated attackers to determine object existence through distinct error responses. Attackers can iterate IDs against deleteMediaItem, updateMediaItem, deleteComment and updateComment mutations to discover hidden draft, private, trashed posts, custom post types, and unapproved comments.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
WPGraphQL · WPGraphQL
CVEs relacionadas — WPGraphQL

No mesmo produto, das mais perigosas para as menos.

CVE-2026-119701MEDIUMWPGraphQL before 2.24.1 Email Flooding via Aliased sendPasswordResetEmail MutationsEPSS 0.6%CVE-2023-23684MEDIUMWordPress WPGraphQL Plugin <= 1.14.5 is vulnerable to Server Side Request Forgery (SSRF)EPSS 0.4%CVE-2026-119702MEDIUMWPGraphQL before 2.24.1 Missing Authorization via createComment MutationEPSS 0.4%CVE-2026-40762HIGHWordPress WPGraphQL plugin < 2.11.1 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-109703MEDIUMWordPress WPGraphQL plugin <= 2.23.1 - Sensitive Data Exposure vulnerabilityEPSS 0.2%CVE-2025-68604MEDIUMWordPress WPGraphQL plugin <= 2.5.3 - Cross Site Request Forgery (CSRF) vulnerabilityEPSS 0.1%