{
 "id": "WPSEC-2026-1077",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1077/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1077/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1077/index.md",
 "title": "WPGraphQL <= 2.24.0 - Unauthenticated Missing Authorization to Comment Creation on Restricted Posts",
 "description": "The WPGraphQL plugin for WordPress is vulnerable to Missing Authorization in the createComment mutation in all versions up to, and including, 2.24.0 due to the mutation only checking whether comments were closed on the target post, without verifying that the post is published, readable by the caller, not trashed and not password-protected, and due to accepting the comment 'date' and 'type' from any commenter. This makes it possible for unauthenticated attackers to create comments on private, draft, pending, trashed or password-protected posts and to backdate comments or file them under other comment types such as pingbacks.",
 "plugin": {
  "slug": "wp-graphql",
  "name": "WPGraphQL",
  "full_name": "WPGraphQL",
  "wordpress_org": "https://wordpress.org/plugins/wp-graphql/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-graphql/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-graphql"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.24.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.24.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.24.1",
 "remediation": "Update to 2.24.1 or later.",
 "fix_released": "2026-10-15T06:48:55+00:00",
 "published": "2026-10-16T11:46:25+00:00",
 "updated": "2026-10-16T10:56:19.853265+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1077/",
  "https://plugins.svn.wordpress.org/wp-graphql/tags/2.24.1/",
  "https://wordpress.org/plugins/wp-graphql/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-graphql",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-16"
 }
}