Vulnerabilities / WPGraphQL / WPSEC-2026-2524
WPGraphQL <= 2.26.0 - Unauthenticated Sensitive Information Exposure via Editorial Notes
Medium 5.3
CWE-284Fixed in 2.26.1
- ID
- WPSEC-2026-2524
- Plugin
- WPGraphQL (wp-graphql)
- Affected
- all versions before 2.26.1
- Remediation
- Update to 2.26.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-284
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-11-04
- Attack surface
- WPGraphQL on WPSec AttackSurface
- Fix released
- Published
Description
The WPGraphQL plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.26.0 due to editorial notes (comments of type 'note') not being treated as private in the Comment model. This makes it possible for unauthenticated attackers, and users who cannot edit the notes, to read internal editorial notes left on content through GraphQL comment queries.
References
- https://wpsec.com/vuln/WPSEC-2026-2524/
- https://plugins.svn.wordpress.org/wp-graphql/tags/2.26.1/
- https://wordpress.org/plugins/wp-graphql/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS