{
 "id": "WPSEC-2026-2525",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2525/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2525/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2525/index.md",
 "title": "WPGraphQL <= 2.26.0 - Unauthenticated Sensitive Information Exposure via Comments Connection Filters",
 "description": "The WPGraphQL plugin for WordPress is vulnerable to Sensitive Information Exposure via the comments connection in all versions up to, and including, 2.26.0 due to insufficient restriction of query arguments, search, ordering and cursors for users who cannot moderate comments. This makes it possible for unauthenticated attackers to use filtering by author email, searching (which matches author email and IP address), ordering by email, IP or user agent, and status, content and cursor filters as an oracle to infer commenters' email addresses and IP addresses and the existence of unapproved comments or comments on private and draft content.",
 "plugin": {
  "slug": "wp-graphql",
  "name": "WPGraphQL",
  "full_name": "WPGraphQL",
  "wordpress_org": "https://wordpress.org/plugins/wp-graphql/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-graphql/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-graphql"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-203"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.26.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.26.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.26.1",
 "remediation": "Update to 2.26.1 or later.",
 "fix_released": "2026-11-03T20:48:19+00:00",
 "published": "2026-11-04T21:42:17+00:00",
 "updated": "2026-11-04T13:59:04.037721+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2525/",
  "https://plugins.svn.wordpress.org/wp-graphql/tags/2.26.1/",
  "https://wordpress.org/plugins/wp-graphql/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-graphql",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-11-04"
 }
}