Vulnerabilities / WPGraphQL
WPGraphQL vulnerabilities
Advisories WPSec published for WPGraphQL. Other sources may list more. Its attack surface: WPGraphQL on WPSec AttackSurface.
| Published | ID | Vulnerability | Severity | Fixed in |
|---|---|---|---|---|
| 2026-10-16 | WPSEC-2026-1079 | WPGraphQL <= 2.24.0 - Authenticated (Contributor+) Sensitive Information Exposure via Trashed Posts | Medium 4.3 | 2.24.1 |
| 2026-10-16 | WPSEC-2026-1078 | WPGraphQL <= 2.24.0 - Authenticated (Author+) Server-Side Request Forgery via 'filePath' Parameter | Medium 4.9 | 2.24.1 |
| 2026-10-16 | WPSEC-2026-1077 | WPGraphQL <= 2.24.0 - Unauthenticated Missing Authorization to Comment Creation on Restricted Posts | Medium 5.3 | 2.24.1 |
| 2026-10-16 | WPSEC-2026-1076 | WPGraphQL <= 2.24.0 - Authenticated (Subscriber+) Missing Authorization to Comment Metadata Modification and Moderation Bypass via updateComment | Medium 4.3 | 2.24.1 |
License: CC BY 4.0