{"id":"CVE-2026-123707","kind":"vulnerability","aliases":["CVE-2026-123707"],"related":[],"title":"WPGraphQL plugin: contributors can read other users' unpublished posts","description":"The WPGraphQL WordPress plugin before 2.27.1 does not restrict access to posts in custom non-public post statuses, allowing users with the Contributor role and above to read the content of other users' posts in those statuses.","summary":"The WPGraphQL WordPress plugin does not restrict access to posts in custom non-public post statuses. A logged-in user with the Contributor role or higher can read the content of other users' posts in those statuses.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["graphql","package","wordpress","wpgraphql"],"not_affected_if":["no-contributor-accounts","no-custom-post-statuses","wpgraphql-2.27.1-or-later"],"how_to_check":"- Check the installed WPGraphQL version in the WordPress admin under Plugins, or with `wp plugin get wp-graphql --field=version`\n- Look for custom post statuses that are not public on your site\n- Confirm whether WPGraphQL is exposed to logged-in users","fix":"- WPGraphQL: move to `2.27.1` or later","status":"open","published_at":"2026-11-15T07:16:54+00:00","first_seen_at":"2026-11-15T07:36:11+00:00","triaged_at":"2026-11-15T07:36:17+00:00","updated_at":"2026-11-15T07:36:17+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-15T07:36:17Z","model":"claude-haiku-5-5","output":{"fix":"- WPGraphQL: move to `2.27.1` or later","reach":"network","title":"WPGraphQL plugin: contributors can read other users' unpublished posts","impact":"low","summary":"The WPGraphQL WordPress plugin does not restrict access to posts in custom non-public post statuses. A logged-in user with the Contributor role or higher can read the content of other users' posts in those statuses.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wpgraphql","graphql"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated contributors read other users' unpublished post content","analyst_note":"product_name and product data are not given; WPGraphQL is the component named in the description.}","how_to_check":"- Check the installed WPGraphQL version in the WordPress admin under Plugins, or with `wp plugin get wp-graphql --field=version`\n- Look for custom post statuses that are not public on your site\n- Confirm whether WPGraphQL is exposed to logged-in users","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-custom-post-statuses","no-contributor-accounts","wpgraphql-2.27.1-or-later"],"who_is_affected":"Sites running WPGraphQL before 2.27.1 that use custom non-public post statuses. The risk needs a logged-in account with at least the Contributor role, so sites without custom post statuses or with only trusted users are lower risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000731,"input_tokens":4524,"output_tokens":558,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-123707':12A,15A '-2026':11A,14A '2.27.1':64C 'access':27B,68C 'allow':78C 'content':51B,89C 'contributor':3A,44B,82C 'custom':31B,72C 'cve':10A,13A 'graphql':16B 'higher':47B 'log':39B 'logged-in':38B 'non':33B,74C 'non-publ':32B,73C 'packag':17B 'plugin':2A,23B,62C 'post':9A,29B,35B,55B,70C,76C,93C 'public':34B,75C 'read':5A,49B,87C 'restrict':26B,67C 'role':45B,83C 'status':36B,58B,77C,96C 'unpublish':8A 'user':7A,41B,54B,79C,92C 'wordpress':18B,22B,61C 'wpgraphql':1A,19B,21B,60C","nicknames":[],"mitigations":[],"who_affected":"Sites running WPGraphQL before 2.27.1 that use custom non-public post statuses. The risk needs a logged-in account with at least the Contributor role, so sites without custom post statuses or with only trusted users are lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["graphql","medium","package","wordpress","wpgraphql"],"campaign_type":null,"search_a":"'-123707':12A,15A '-2026':11A,14A 'contributor':3A 'cve':10A,13A 'plugin':2A 'post':9A 'read':5A 'unpublish':8A 'user':7A 'wpgraphql':1A","search_b":"'access':27B 'content':51B 'contributor':44B 'custom':31B 'graphql':16B 'higher':47B 'log':39B 'logged-in':38B 'non':33B 'non-publ':32B 'packag':17B 'plugin':23B 'post':29B,35B,55B 'public':34B 'read':49B 'restrict':26B 'role':45B 'status':36B,58B 'user':41B,54B 'wordpress':18B,22B 'wpgraphql':19B,21B","search_c":"'2.27.1':64C 'access':68C 'allow':78C 'content':89C 'contributor':82C 'custom':72C 'non':74C 'non-publ':73C 'plugin':62C 'post':70C,76C,93C 'public':75C 'read':87C 'restrict':67C 'role':83C 'status':77C,96C 'user':79C,92C 'wordpress':61C 'wpgraphql':60C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T07:16:54+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123707","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123707","severity":null,"published_at":"2026-11-15T07:16:54+00:00","modified_at":"2026-11-15T07:16:54+00:00","first_seen_at":"2026-11-15T07:36:11+00:00","fetched_at":"2026-11-15T07:36:11+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}