CVE-2026-119700
WPGraphQL before 2.24.2 Object Existence Disclosure via Media and Comment Mutations
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
WPGraphQL before 2.24.2 contains an information disclosure vulnerability that allows unauthenticated attackers to determine object existence through distinct error responses. Attackers can iterate IDs against deleteMediaItem, updateMediaItem, deleteComment and updateComment mutations to discover hidden draft, private, trashed posts, custom post types, and unapproved comments.
| CWE | CWE-204 |
| Vendor | wpgraphql |
| Product | wpgraphql |
| Published | Oct 30, 2026 |
| Last Updated | Oct 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for wpgraphql wpgraphql
Be the first to know when new medium vulnerabilities affecting wpgraphql wpgraphql are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
WPGraphQL / WPGraphQL
0 < 2.24.2
References
github.com: https://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-r7m4-3v6c-3435 github.com: https://github.com/wp-graphql/wp-graphql/commit/3fb1904acff4df00287ef6278fe40438d276a9f9 github.com: https://github.com/wp-graphql/wp-graphql/commit/bb4f778cae04f60c40bbcb1c80bed4faf91ad836 github.com: https://github.com/wp-graphql/wp-graphql/blob/wp-graphql/v2.24.0/plugins/wp-graphql/src/Mutation/MediaItemDelete.php github.com: https://github.com/wp-graphql/wp-graphql/releases/tag/wp-graphql%2Fv2.24.2 github.com: https://github.com/wp-graphql/wp-graphql vulncheck.com: https://www.vulncheck.com/advisories/wpgraphql-before-2.24.2-object-existence-disclosure-via-media-and-comment-mutations
Credits
pnn219