WPGraphQL before 2.24.2 Object Existence Disclosure via Media and Comment Mutations

WPGraphQL · CWE-204 · CWE-204

AffectedWPGraphQL

FixUpdate to 2.24.2 or newer

PublishedOct 30, 15:16 · VulnCheck

ScoredOct 30 · 5.3 · VulnCheck

Exploit code publicNone known · checked 21:18 UTC

ExploitedNone known · CISA KEV checked 22:11 UTC

What we know

No known exploitation. CISA KEV, checked 22:11 UTC.

No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.

An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.

Description

WPGraphQL before 2.24.2 contains an information disclosure vulnerability that allows unauthenticated attackers to determine object existence through distinct error responses. Attackers can iterate IDs against deleteMediaItem, updateMediaItem, deleteComment and updateComment mutations to discover hidden draft, private, trashed posts, custom post types, and unapproved comments.

From VulnCheck

Affected and fixed versions

ProductAffectedFixed inWPGraphQLbefore 2.24.22.24.2

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

GitHub Security Advisory (GHSA-r7m4-3v6c-3435) · github.comvendor advisory github.com/wp-graphql/wp-graphql/commit/3fb1904acff4df00287ef6278fe40438d276a9f9 · github.compatch github.com/wp-graphql/wp-graphql/commit/bb4f778cae04f60c40bbcb1c80bed4faf91ad836 · github.compatch github.com/wp-graphql/wp-graphql/blob/wp-graphql/v2.24.0/plugins/wp-graphql/src/Mutation/MediaItemDelete.php · github.comtechnical description WPGraphQL wp-graphql/v2.24.2 Release Notes · github.comrelease notes github.com/wp-graphql/wp-graphql · github.comproduct VulnCheck Advisory: WPGraphQL before 2.24.2 Object Existence Disclosure via Media and Comment Mutations · vulncheck.comthird party advisory

Other CVEs in WPGraphQL

All 3 →

6.5WPGraphQL before 2.24.1 Missing Authorization via createComment Mutation · CVE-2026-119702Oct 30 5.3WPGraphQL before 2.24.1 Email Flooding via Aliased sendPasswordResetEmail Mutations · CVE-2026-119701Oct 30 7.5WordPress Plugin WPGraphQL 1.3.5 Denial of Service · CVE-2021-47959May 15