CVE-2026-119700

CVSS 6.9 (medium) · published 2026-10-30

WPGraphQL before 2.24.2 contains an information disclosure vulnerability that allows unauthenticated attackers to determine object existence through distinct error responses. Attackers can iterate IDs against deleteMediaItem, updateMediaItem, deleteComment and updateComment mutations to discover hidden draft, private, trashed posts, custom post types, and unapproved comments.

Weakness: CWE-204

Source: NVD CVE-2026-119700

References

• https://github.com/wp-graphql/wp-graphql
• https://github.com/wp-graphql/wp-graphql/blob/wp-graphql/v2.24.0/plugins/wp-graphql/src/Mutation/MediaItemDelete.php
• https://github.com/wp-graphql/wp-graphql/commit/3fb1904acff4df00287ef6278fe40438d276a9f9
• https://github.com/wp-graphql/wp-graphql/commit/bb4f778cae04f60c40bbcb1c80bed4faf91ad836
• https://github.com/wp-graphql/wp-graphql/releases/tag/wp-graphql%2Fv2.24.2
• https://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-r7m4-3v6c-3435
• https://www.vulncheck.com/advisories/wpgraphql-before-2.24.2-object-existence-disclosure-via-media-and-comment-mutations

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.