---
id: "CVE-2026-119700"
kind: "vulnerability"
aliases: ["CVE-2026-119700"]
title: "WPGraphQL: distinct error responses reveal hidden posts and comments to anonymous users"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wpgraphql"]
not_affected_if: ["wpgraphql-2.24.2-or-later", "wpgraphql-not-installed"]
published_at: "2026-10-30T16:17:50+00:00"
first_seen_at: "2026-10-30T16:31:26+00:00"
updated_at: "2026-10-30T16:32:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119700", "first_seen_at": "2026-10-30T16:31:26+00:00"}]
---

# WPGraphQL: distinct error responses reveal hidden posts and comments to anonymous users

WPGraphQL before 2.24.2 returns different errors for existing and missing object IDs in some mutations. An unauthenticated attacker can iterate IDs to learn that hidden draft, private, trashed, custom-type posts and unapproved comments exist.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed WPGraphQL plugin version in the WordPress admin plugin list or `wp plugin get wp-graphql --field=version`
- Confirm whether the site exposes the GraphQL endpoint to anonymous visitors (unknown if the sources do not say how to test this)

## Fix

- WPGraphQL: `2.24.2`

## Timeline

- 2026-10-30T16:31:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119700

## From the sources

WPGraphQL before 2.24.2 contains an information disclosure vulnerability that allows unauthenticated attackers to determine object existence through distinct error responses. Attackers can iterate IDs against deleteMediaItem, updateMediaItem, deleteComment and updateComment mutations to discover hidden draft, private, trashed posts, custom post types, and unapproved comments.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_