Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: WPGraphQL 2.24.1 Clear all filters
TI-2026-83177 CVE-2026-119702 · GHSA-wj7h-xjr7-93c6

WPGraphQL createComment lets attackers comment on hidden posts

Priority LOW 36

WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allows unauthenticated attackers to comment on non-public posts by bypassing post status checks.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00361 Published 2026-10-30 Fixed in 2.24.1 CWE-862
TI-2026-83176 CVE-2026-119701 · GHSA-f8vm-v352-pm3p

Email flooding in WPGraphQL via aliased password reset mutations

Priority LOW 37

WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to flood password reset emails by aliasing the sendPasswordResetEmail mutation.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0059 Published 2026-10-30 Fixed in 2.24.1 CWE-770