WPGraphQL before 2.24.1 Missing Authorization via createComment Mutation

WPGraphQL · Missing authorization · CWE-862

AffectedWPGraphQL

FixUpdate to 2.24.1 or newer

PublishedOct 30, 15:16 · VulnCheck

ScoredOct 30 · 6.5 · VulnCheck

Exploit code publicNone known · checked 21:18 UTC

ExploitedNone known · CISA KEV checked 22:11 UTC

What we know

No known exploitation. CISA KEV, checked 22:11 UTC.

No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.

An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.

Description

WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allows unauthenticated attackers to comment on non-public posts by bypassing post status checks. Attackers can attach comments to draft, private, trashed, or password-protected posts to leak hidden titles via moderator notifications, enumerate post IDs, and backdate comments or mark them as pingbacks.

From VulnCheck

Affected and fixed versions

ProductAffectedFixed inWPGraphQLbefore 2.24.12.24.1

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

GitHub Security Advisory (GHSA-4vgv-vvxr-9fh9) · github.comvendor advisory github.com/wp-graphql/wp-graphql/commit/b9da32bd8e6025e19a9b04acaa129978eba71177 · github.compatch github.com/wp-graphql/wp-graphql/blob/wp-graphql/v2.24.0/plugins/wp-graphql/src/Mutation/CommentCreate.php · github.comtechnical description WPGraphQL wp-graphql/v2.24.1 Release Notes · github.comrelease notes github.com/wp-graphql/wp-graphql · github.comproduct VulnCheck Advisory: WPGraphQL before 2.24.1 Missing Authorization via createComment Mutation · vulncheck.comthird party advisory

Other CVEs in WPGraphQL

All 3 →

5.3WPGraphQL before 2.24.1 Email Flooding via Aliased sendPasswordResetEmail Mutations · CVE-2026-119701Oct 30 5.3WPGraphQL before 2.24.2 Object Existence Disclosure via Media and Comment Mutations · CVE-2026-119700Oct 30 7.5WordPress Plugin WPGraphQL 1.3.5 Denial of Service · CVE-2021-47959May 15