{"id":"CVE-2026-119700","kind":"vulnerability","aliases":["CVE-2026-119700"],"related":[],"title":"WPGraphQL: distinct error responses reveal hidden posts and comments to anonymous users","description":"WPGraphQL before 2.24.2 contains an information disclosure vulnerability that allows unauthenticated attackers to determine object existence through distinct error responses. Attackers can iterate IDs against deleteMediaItem, updateMediaItem, deleteComment and updateComment mutations to discover hidden draft, private, trashed posts, custom post types, and unapproved comments.","summary":"WPGraphQL before 2.24.2 returns different errors for existing and missing object IDs in some mutations. An unauthenticated attacker can iterate IDs to learn that hidden draft, private, trashed, custom-type posts and unapproved comments exist.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wpgraphql"],"not_affected_if":["wpgraphql-2.24.2-or-later","wpgraphql-not-installed"],"how_to_check":"- Check the installed WPGraphQL plugin version in the WordPress admin plugin list or `wp plugin get wp-graphql --field=version`\n- Confirm whether the site exposes the GraphQL endpoint to anonymous visitors (unknown if the sources do not say how to test this)","fix":"- WPGraphQL: `2.24.2`","status":"open","published_at":"2026-10-30T16:17:50+00:00","first_seen_at":"2026-10-30T16:31:26+00:00","triaged_at":"2026-10-30T16:32:15+00:00","updated_at":"2026-10-30T16:32:15+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T16:32:15Z","model":"claude-haiku-5-5","output":{"fix":"- WPGraphQL: `2.24.2`","reach":"internet","title":"WPGraphQL: distinct error responses reveal hidden posts and comments to anonymous users","impact":"low","summary":"WPGraphQL before 2.24.2 returns different errors for existing and missing object IDs in some mutations. An unauthenticated attacker can iterate IDs to learn that hidden draft, private, trashed, custom-type posts and unapproved comments exist.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wpgraphql","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"attacker learns hidden post and comment IDs exist","analyst_note":"","how_to_check":"- Check the installed WPGraphQL plugin version in the WordPress admin plugin list or `wp plugin get wp-graphql --field=version`\n- Confirm whether the site exposes the GraphQL endpoint to anonymous visitors (unknown if the sources do not say how to test this)","plain_action":"","needs_analyst":false,"not_affected_if":["wpgraphql-not-installed","wpgraphql-2.24.2-or-later"],"who_is_affected":"Sites running the WPGraphQL plugin before 2.24.2 that expose its GraphQL endpoint to the public. The flaw discloses only whether an object ID exists, not its contents, so exposure is limited to information about hidden content. Sites that do not use WPGraphQL can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.0007,"input_tokens":4156,"output_tokens":568,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119700':15A,18A '-2026':14A,17A '2.24.2':27B,63C 'allow':70C 'anonym':11A 'attack':42B,72C,81C 'comment':9A,59B,104C 'contain':64C 'custom':54B,99C 'custom-typ':53B 'cve':13A,16A 'deletecom':88C 'deletemediaitem':86C 'determin':74C 'differ':29B 'disclosur':67C 'discov':93C 'distinct':2A,78C 'draft':50B,95C 'error':3A,30B,79C 'exist':32B,60B,76C 'hidden':6A,49B,94C 'host':22B 'id':36B,45B,84C 'inform':66C 'iter':44B,83C 'learn':47B 'miss':34B 'mutat':39B,91C 'object':35B,75C 'packag':19B 'post':7A,56B,98C,100C 'privat':51B,96C 'respons':4A,80C 'return':28B 'reveal':5A 'self':21B 'self-host':20B 'trash':52B,97C 'type':55B,101C 'unapprov':58B,103C 'unauthent':41B,71C 'updatecom':90C 'updatemediaitem':87C 'user':12A 'vulner':68C 'wordpress':23B 'wpgraphql':1A,24B,25B,61C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WPGraphQL plugin before 2.24.2 that expose its GraphQL endpoint to the public. The flaw discloses only whether an object ID exists, not its contents, so exposure is limited to information about hidden content. Sites that do not use WPGraphQL can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T16:17:50+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119700","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119700","severity":null,"published_at":"2026-10-30T16:17:50+00:00","modified_at":"2026-10-30T16:17:50+00:00","first_seen_at":"2026-10-30T16:31:26+00:00","fetched_at":"2026-10-30T16:31:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}