Live › vulnerability › CVE-2026-119700
WPGraphQL before 2.24.2 returns different errors for existing and missing object IDs in some mutations. An unauthenticated attacker can iterate IDs to learn that hidden draft, private, trashed, custom-type posts and unapproved comments exist.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 16:31 UTC. All times on this page are UTC.
Sites running the WPGraphQL plugin before 2.24.2 that expose its GraphQL endpoint to the public. The flaw discloses only whether an object ID exists, not its contents, so exposure is limited to information about hidden content. Sites that do not use WPGraphQL can skip it.
No product ranges from the sources yet.
wp plugin get wp-graphql --field=version2.24.2Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
WPGraphQL before 2.24.2 contains an information disclosure vulnerability that allows unauthenticated attackers to determine object existence through distinct error responses. Attackers can iterate IDs against deleteMediaItem, updateMediaItem, deleteComment and updateComment mutations to discover hidden draft, private, trashed posts, custom post types, and unapproved comments.
This page as .md · .json · in your agent: get_signal("CVE-2026-119700")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.