CVE-2026-119702mediumCWE-862

CVE-2026-119702: falha de média gravidade em WPGraphQL

WPGraphQL before 2.24.1 Missing Authorization via createComment Mutation

Publicada em

Seguir esta CVE+ Monitorar WPGraphQL

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.9epss 0.4%
WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allows unauthenticated attackers to comment on non-public posts by bypassing post status checks. Attackers can attach comments to draft, private, trashed, or password-protected posts to leak hidden titles via moderator notifications, enumerate post IDs, and backdate comments or mark them as pingbacks.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
WPGraphQL · WPGraphQL
CVEs relacionadas — WPGraphQL

No mesmo produto, das mais perigosas para as menos.

CVE-2026-119701MEDIUMWPGraphQL before 2.24.1 Email Flooding via Aliased sendPasswordResetEmail MutationsEPSS 0.6%CVE-2023-23684MEDIUMWordPress WPGraphQL Plugin <= 1.14.5 is vulnerable to Server Side Request Forgery (SSRF)EPSS 0.4%CVE-2026-119700MEDIUMWPGraphQL before 2.24.2 Object Existence Disclosure via Media and Comment MutationsEPSS 0.4%CVE-2026-40762HIGHWordPress WPGraphQL plugin < 2.11.1 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-109703MEDIUMWordPress WPGraphQL plugin <= 2.23.1 - Sensitive Data Exposure vulnerabilityEPSS 0.2%CVE-2025-68604MEDIUMWordPress WPGraphQL plugin <= 2.5.3 - Cross Site Request Forgery (CSRF) vulnerabilityEPSS 0.1%