CVE-2026-119702

Impact

WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allows unauthenticated attackers to comment on non-public posts by bypassing post status checks. Attackers can attach comments to draft, private, trashed, or password-protected posts to leak hidden titles via moderator notifications, enumerate post IDs, and backdate comments or mark them as pingbacks.

Affected products

Versions were read from the advisory text. No structured product data has been published for this record yet.

Weakness classification

References

• NVD record
• CVE.org record
• https://github.com/wp-graphql/wp-graphql
• https://github.com/wp-graphql/wp-graphql/blob/wp-graphql/v2.24.0/plugins/wp-graphql/src/Mutation/CommentCreate.php
• https://github.com/wp-graphql/wp-graphql/commit/b9da32bd8e6025e19a9b04acaa129978eba71177
• https://github.com/wp-graphql/wp-graphql/releases/tag/wp-graphql%2Fv2.24.1
• https://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-4vgv-vvxr-9fh9
• https://www.vulncheck.com/advisories/wpgraphql-before-2.24.1-missing-authorization-via-createcomment-mutation