Skip to content
OpenAdvisories

Vendor

wp-graphql

4 known vulnerabilities.

Products

wp-graphql 4
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.4
    CVE-2026-88974

    WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost

    WPGraphQL provides a GraphQL API for WordPress sites. Prior to 2.22.2, the updatePost mutation in src/Mutation/PostObjectUpdate.php checks only the collection-level edit_posts capability and the post author, but does not enforce the object-level edit_post cap…

    wp-graphql wp-graphql wp-graphql/wp-graphql Packagist
  • Medium 6.9
    CVE-2026-54768

    WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)

    WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts through the sendPasswordResetEmail mutation and…

    wp-graphql wp-graphql wp-graphql/wp-graphql Packagist
  • Medium 4.3
    CVE-2026-33290

    WPGraphQL Repo's updateComment allows low-privileged authenticated users to change comment moderation status (comment_approved) without moderate_comments permission

    WPGraphQL provides a GraphQL API for WordPress sites. Prior to version 2.10.0, an authorization flaw in updateComment allows an authenticated low-privileged user (including a custom role with zero capabilities) to change moderation status of their own comment…

    wp-graphql wp-graphql