WPGraphQL <= 2.24.0 - Unauthenticated Missing Authorization to Comment Creation on Restricted Posts
- ID
- WPSEC-2026-1077
- Plugin
- WPGraphQL (wp-graphql)
- Affected
- all versions before 2.24.1
- Remediation
- Update to 2.24.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-16
- Attack surface
- WPGraphQL on WPSec AttackSurface
- Fix released
- Published
Description
The WPGraphQL plugin for WordPress is vulnerable to Missing Authorization in the createComment mutation in all versions up to, and including, 2.24.0 due to the mutation only checking whether comments were closed on the target post, without verifying that the post is published, readable by the caller, not trashed and not password-protected, and due to accepting the comment 'date' and 'type' from any commenter. This makes it possible for unauthenticated attackers to create comments on private, draft, pending, trashed or password-protected posts and to backdate comments or file them under other comment types such as pingbacks.
References
- https://wpsec.com/vuln/WPSEC-2026-1077/
- https://plugins.svn.wordpress.org/wp-graphql/tags/2.24.1/
- https://wordpress.org/plugins/wp-graphql/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS