CVE-2026-119702 WPGraphQL before 2.24.1 Missing Authorization via createComment Mutation
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-119702?
CVE-2026-119702 is a medium-severity vulnerability in WPGraphQL, published on 30 Oct 2026.
Official description
WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allows unauthenticated attackers to comment on non-public posts by bypassing post status checks. Attackers can attach comments to draft, private, trashed, or password-protected posts to leak hidden titles via moderator notifications, enumerate post IDs, and backdate comments or mark them as pingbacks.
Weakness: CWE-862
Which versions are affected by CVE-2026-119702?
How do I fix CVE-2026-119702?
No fix has been published for CVE-2026-119702 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-119702 being exploited?
There is no known exploitation of CVE-2026-119702 in the wild and no public exploit code.
Sources
Also known as GHSA-4vgv-vvxr-9fh9, GHSA-wj7h-xjr7-93c6.