Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 7

Export CSV
CVE-2026-119700

WPGraphQL before 2.24.2 Object Existence Disclosure via Media and Comment Mutations

WPGraphQL before 2.24.2 contains an information disclosure vulnerability that allows unauthenticated attackers to determine object existence through distinct error responses. Attackers can iterate IDs against deleteMediaItem, updateMediaItem, deleteComment and updateComment mutations to discover hidden draft, private, trashed posts, custom post types, and unapproved comments.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wpgraphql
Products
Wpgraphql Wpgraphql
CVE-2026-119699

WPGraphQL Smart Cache before 2.3.3 Unbounded Persisted Query Storage DoS

WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to persist unlimited query documents via the Automatic Persisted Query handler. Attackers can send distinct queries with matching SHA-256 queryId values, including batched operations, to grow the wp_posts table without bound and degrade database performance.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wpgraphql
Products
Wpgraphql Smart Cache Wpgraphql Smart Cache
CVE-2026-119702

WPGraphQL before 2.24.1 Missing Authorization via createComment Mutation

WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allows unauthenticated attackers to comment on non-public posts by bypassing post status checks. Attackers can attach comments to draft, private, trashed, or password-protected posts to leak hidden titles via moderator notifications, enumerate post IDs, and backdate comments or mark them as pingbacks.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wpgraphql
Products
Wpgraphql Wpgraphql
CVE-2026-119701

WPGraphQL before 2.24.1 Email Flooding via Aliased sendPasswordResetEmail Mutations

WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to flood password reset emails by aliasing the sendPasswordResetEmail mutation. Attackers can send one HTTP request with many aliases, bypassing batch_limit, to exhaust mail provider quota and repeatedly rotate reset keys, blocking legitimate password recovery.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wpgraphql
Products
Wpgraphql Wpgraphql
CVE-2026-109703

WordPress WPGraphQL plugin <= 2.23.1 - Sensitive Data Exposure vulnerability

Missing Authorization vulnerability in WPGraphQL WPGraphQL wp-graphql allows Retrieve Embedded Sensitive Data.This issue affects WPGraphQL: from n/a through 2.23.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wpgraphql
Products
Wpgraphql Wpgraphql
CVE-2026-92099

WPGraphQL Smart Cache < 2.3.2 - Unauthenticated Persisted Query Registration and Alias Squatting

The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authorisation or validate a caller-supplied query identifier before storing a persisted query from a request, allowing unauthenticated users to publish arbitrary query documents and claim query aliases before a site's own frontend registers them.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Wpgraphql Smart Cache
CVE-2026-88974

WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost

WPGraphQL provides a GraphQL API for WordPress sites. Prior to 2.22.2, the updatePost mutation in src/Mutation/PostObjectUpdate.php checks only the collection-level edit_posts capability and the post author, but does not enforce the object-level edit_post capability or require publish_posts for public status transitions. An authenticated Contributor can therefore publish the Contributor's own draft without editorial approval or modify the Contributor's previously published post despite lacking edit_published_posts, while posts owned by other authors remain protected. This issue is fixed in version 2.22.2.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wpgraphql
Products
Wpgraphql Wpgraphql