Live › vulnerability › CVE-2026-119702
WPGraphQL's createComment mutation skips post status checks, so anyone can comment on draft, private, trashed or password-protected posts. An attacker can leak hidden post titles through moderator notifications, enumerate post IDs, and backdate comments or mark them as pingbacks.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 16:31 UTC. All times on this page are UTC.
Sites running WPGraphQL below 2.24.1 that expose the GraphQL endpoint to the internet are exposed, since the mutation needs no login. Sites that do not use WPGraphQL, or that run a fixed version, are not affected. The sources do not say whether managed hosting changes exposure.
No product ranges from the sources yet.
wp plugin get wp-graphql --field=version with WP-CLI./graphql) that accepts comment mutations.2.24.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allows unauthenticated attackers to comment on non-public posts by bypassing post status checks. Attackers can attach comments to draft, private, trashed, or password-protected posts to leak hidden titles via moderator notifications, enumerate post IDs, and backdate comments or mark them as pingbacks.
This page as .md · .json · in your agent: get_signal("CVE-2026-119702")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.