CVE-2026-119700: WPGraphQL before 2.24.2 Object Existence Disclosure via Media and Comment Mutations
WPGraphQL before 2.24.2 contains an information disclosure vulnerability that allows unauthenticated attackers to determine object existence through distinct error responses. Attackers can iterate IDs against deleteMediaItem, updateMediaItem, deleteComment and updateComment mutations to discover hidden draft, private, trashed posts, custom post types, and unapproved comments.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WPGraphQLto a version that resolves this vulnerability.Fixed in 2.24.2
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker who can send requests to the affected WPGraphQL mutations can probe object IDs. No privileges or user interaction are required.
What information can an attacker learn?
An attacker can distinguish error responses to determine whether IDs correspond to hidden draft, private, or trashed posts, custom post types, and unapproved comments. The issue discloses object existence rather than the object contents.
Which operations are relevant for detecting exposure?
The affected mutation paths are deleteMediaItem, updateMediaItem, deleteComment, and updateComment. Exposure exists when these mutations produce distinguishable responses for existing versus non-existing or inaccessible objects.
What version addresses the issue?
The vulnerability affects WPGraphQL versions before 2.24.2. Updating to version 2.24.2 or later addresses the affected version range.