GHSA-r7m4-3v6c-3435: WPGraphQL before 2.24.2 Object Existence Disclosure via Media and Comment Mutations

Q: Who is exposed to this issue?

Sites running WPGraphQL before version 2.24.2 are exposed. The affected mutations can be queried by unauthenticated attackers over the network.

Q: What can an attacker learn or do?

An attacker can iterate object IDs and use distinct error responses from deleteMediaItem, updateMediaItem, deleteComment, and updateComment to determine whether objects exist. This can disclose the existence of hidden draft, private, or trashed posts, custom post types, and unapproved comments; the provided data does not indicate that the attacker can read or modify those objects.

Q: What is required to exploit it?

No authentication, user interaction, or special conditions are required according to the supplied vector. The attacker needs to be able to send requests to the affected WPGraphQL mutations and test object identifiers.

Q: How can I remediate the issue?

Upgrade WPGraphQL to version 2.24.2 or later. The provided release reference identifies 2.24.2 as the version containing the fix.

Published Oct 30, 2026

Updated

WPGraphQL before 2.24.2 contains an information disclosure vulnerability that allows unauthenticated attackers to determine object existence through distinct error responses. Attackers can iterate IDs against deleteMediaItem, updateMediaItem, deleteComment and updateComment mutations to discover hidden draft, private, trashed posts, custom post types, and unapproved comments.

Affected Software

1 affected component

WPGraphQL WPGraphQL<2.24.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WPGraphQL to a version that resolves this vulnerability.
Fixed in 2.24.2

Event History

Oct 30, 2026

CVE Published

via OSV·03:16 PM

Data Sourced

via OSV·03:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Sites running WPGraphQL before version 2.24.2 are exposed. The affected mutations can be queried by unauthenticated attackers over the network.

What can an attacker learn or do?

An attacker can iterate object IDs and use distinct error responses from deleteMediaItem, updateMediaItem, deleteComment, and updateComment to determine whether objects exist. This can disclose the existence of hidden draft, private, or trashed posts, custom post types, and unapproved comments; the provided data does not indicate that the attacker can read or modify those objects.

What is required to exploit it?

No authentication, user interaction, or special conditions are required according to the supplied vector. The attacker needs to be able to send requests to the affected WPGraphQL mutations and test object identifiers.

How can I remediate the issue?

Upgrade WPGraphQL to version 2.24.2 or later. The provided release reference identifies 2.24.2 as the version containing the fix.

GHSA-r7m4-3v6c-3435: WPGraphQL before 2.24.2 Object Existence Disclosure via Media and Comment Mutations

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What can an attacker learn or do?

What is required to exploit it?

How can I remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What can an attacker learn or do?

What is required to exploit it?

How can I remediate the issue?