{
 "id": "WPSEC-2026-3011",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3011/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3011/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3011/index.md",
 "title": "WPGraphQL <= 2.27.0 - Authenticated (Contributor+) Sensitive Information Exposure via GraphQL Post Queries",
 "description": "The WPGraphQL plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.27.0 due to an incorrect authorization check in the Post model's restricted capability logic, which only required the edit_others_posts capability for posts in the draft, future, pending and trash statuses. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the full content of other users' posts in other non-public statuses, such as custom statuses registered as non-public or statuses that are no longer registered, through GraphQL queries.",
 "plugin": {
  "slug": "wp-graphql",
  "name": "WPGraphQL",
  "full_name": "WPGraphQL",
  "wordpress_org": "https://wordpress.org/plugins/wp-graphql/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-graphql/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-graphql"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-863"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.27.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.27.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.27.1",
 "remediation": "Update to 2.27.1 or later.",
 "fix_released": "2026-11-11T22:08:28+00:00",
 "published": "2026-11-12T22:43:10+00:00",
 "updated": "2026-11-12T17:11:42.796501+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3011/",
  "https://plugins.svn.wordpress.org/wp-graphql/tags/2.27.1/",
  "https://wordpress.org/plugins/wp-graphql/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-graphql",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-12"
 }
}