# WPGraphQL <= 2.27.0 - Authenticated (Contributor+) Sensitive Information Exposure via GraphQL Post Queries

- **ID:** WPSEC-2026-3011
- **Plugin:** WPGraphQL (`wp-graphql`), https://wordpress.org/plugins/wp-graphql/
- **Affected versions:** all versions before 2.27.1
- **Fixed in:** 2.27.1 (Update to 2.27.1 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-863
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-graphql
- **Fix released:** 2026-11-11
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3011/

## Description

The WPGraphQL plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.27.0 due to an incorrect authorization check in the Post model's restricted capability logic, which only required the edit_others_posts capability for posts in the draft, future, pending and trash statuses. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the full content of other users' posts in other non-public statuses, such as custom statuses registered as non-public or statuses that are no longer registered, through GraphQL queries.

## References

- https://wpsec.com/vuln/WPSEC-2026-3011/
- https://plugins.svn.wordpress.org/wp-graphql/tags/2.27.1/
- https://wordpress.org/plugins/wp-graphql/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3011/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.