# WPGraphQL <= 2.24.0 - Unauthenticated Missing Authorization to Comment Creation on Restricted Posts

- **ID:** WPSEC-2026-1077
- **Plugin:** WPGraphQL (`wp-graphql`), https://wordpress.org/plugins/wp-graphql/
- **Affected versions:** all versions before 2.24.1
- **Fixed in:** 2.24.1 (Update to 2.24.1 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-16)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-graphql
- **Fix released:** 2026-10-15
- **Published:** 2026-10-16
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1077/

## Description

The WPGraphQL plugin for WordPress is vulnerable to Missing Authorization in the createComment mutation in all versions up to, and including, 2.24.0 due to the mutation only checking whether comments were closed on the target post, without verifying that the post is published, readable by the caller, not trashed and not password-protected, and due to accepting the comment 'date' and 'type' from any commenter. This makes it possible for unauthenticated attackers to create comments on private, draft, pending, trashed or password-protected posts and to backdate comments or file them under other comment types such as pingbacks.

## References

- https://wpsec.com/vuln/WPSEC-2026-1077/
- https://plugins.svn.wordpress.org/wp-graphql/tags/2.24.1/
- https://wordpress.org/plugins/wp-graphql/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1077/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.