Read the docs
TI-2026-83175 Aliases CVE-2026-119700GHSA-rgvw-jqg8-92x3

Object existence disclosure in WPGraphQL via media and comment mutations

Priority LOW 36CWE-204Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-204.

Summary

WPGraphQL before 2.24.2 returns distinct error responses that reveal whether an object exists. An unauthenticated attacker can iterate IDs against the deleteMediaItem, updateMediaItem, deleteComment and updateComment mutations to discover hidden draft, private, trashed posts, custom post types and unapproved comments. The weakness is classified as CWE-204.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

WPGraphQL before 2.24.2 contains an information disclosure vulnerability that allows unauthenticated attackers to determine object existence through distinct error responses. Attackers can iterate IDs against deleteMediaItem, updateMediaItem, deleteComment and updateComment mutations to discover hidden draft, private, trashed posts, custom post types, and unapproved comments.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00363 30th percentileScored 2026-11-07
Fix Fixed WPGraphQL (WPGraphQL): 2.24.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WPGraphQLWPGraphQLbefore 2.24.22.24.2Patch availableCNA
  • WPGraphQL VendorWPGraphQL Affected before 2.24.2 Fixed in 2.24.2 Patch available CNA

Remediation

Update WPGraphQL to version 2.24.2, the fixed version.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

  • Fix · CNA WPGraphQL (WPGraphQL) Fixed in 2.24.2

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-119700
  2. 2026-10-30 Alias added: GHSA-rgvw-jqg8-92x3
  3. 2026-11-01 Priority changed: MEDIUM → LOW
  4. 2026-11-05 CISA SSVC decision points changed

References

Patch 2

Advisory 1

Other 3

  • TI-2021-22572 WordPress Plugin WPGraphQL 1.3.5 Denial of Service CVSS 4.0HIGH 8.7
  • TI-2026-39574 WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user… CVSS 4.0MEDIUM 6.9
  • TI-2026-22282 WPGraphQL Repo Vulnerable to Command Injection via Unsanitized GitHub Actions Expression in Release Workflow CVSS 3.1HIGH 7.7
  • TI-2026-60306 WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost CVSS 3.1MEDIUM 5.4
  • TI-2026-25701 Missing authorization in WPGraphQL wp-graphql CVSS 3.1MEDIUM 4.3
  • TI-2026-83176 Email flooding in WPGraphQL via aliased password reset mutations CVSS 4.0MEDIUM 6.9
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences