CVE-2026-123707: WPGraphQL < 2.27.1 - Contributor+ Custom Post Status Content Disclosure

Q: Who can exploit this issue?

Any authenticated WordPress user with the Contributor role or a higher-privileged role can exploit it. The affected content belongs to other users and must be in a custom non-public post status.

Q: What content is exposed?

The issue allows reading the content of posts assigned to custom non-public post statuses. It does not state that standard non-public statuses or publicly available posts are affected.

Q: Which installations are affected?

WPGraphQL versions before 2.27.1 are affected. Installations using version 2.27.1 or later are not identified as affected by the provided information.

Published Nov 15, 2026

Updated

The WPGraphQL WordPress plugin before 2.27.1 does not restrict access to posts in custom non-public post statuses, allowing users with the Contributor role and above to read the content of other users' posts in those statuses.

Affected Software

1 affected component

WPGraphQL WPGraphQL<2.27.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.27.1

Event History

Nov 15, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:16 AM

Description

Frequently Asked Questions

Who can exploit this issue?

Any authenticated WordPress user with the Contributor role or a higher-privileged role can exploit it. The affected content belongs to other users and must be in a custom non-public post status.

What content is exposed?

The issue allows reading the content of posts assigned to custom non-public post statuses. It does not state that standard non-public statuses or publicly available posts are affected.

Which installations are affected?

WPGraphQL versions before 2.27.1 are affected. Installations using version 2.27.1 or later are not identified as affected by the provided information.

CVE-2026-123707: WPGraphQL < 2.27.1 - Contributor+ Custom Post Status Content Disclosure

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What content is exposed?

Which installations are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What content is exposed?

Which installations are affected?