WPGraphQL <= 2.27.0 - Authenticated (Contributor+) Sensitive Information Exposure via GraphQL Post Queries
- ID
- WPSEC-2026-3011
- Plugin
- WPGraphQL (wp-graphql)
- Affected
- all versions before 2.27.1
- Remediation
- Update to 2.27.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-863
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-12
- Attack surface
- WPGraphQL on WPSec AttackSurface
- Fix released
- Published
Description
The WPGraphQL plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.27.0 due to an incorrect authorization check in the Post model's restricted capability logic, which only required the edit_others_posts capability for posts in the draft, future, pending and trash statuses. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the full content of other users' posts in other non-public statuses, such as custom statuses registered as non-public or statuses that are no longer registered, through GraphQL queries.
References
- https://wpsec.com/vuln/WPSEC-2026-3011/
- https://plugins.svn.wordpress.org/wp-graphql/tags/2.27.1/
- https://wordpress.org/plugins/wp-graphql/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS