CVE-2026-119700

Medium

Description

WPGraphQL before 2.24.2 contains an information disclosure vulnerability that allows unauthenticated attackers to determine object existence through distinct error responses. Attackers can iterate IDs against deleteMediaItem, updateMediaItem, deleteComment and updateComment mutations to discover hidden draft, private, trashed posts, custom post types, and unapproved comments.

SeverityMedium

CVSS5.3

Exploit probability—

ProductWPGraphQL

PublishedOct 30, 2026

First seenNov 4, 2026

Weakness typeCWE-204CWE-204

How to fix

Update

WPGraphQL WPGraphQL2.24.2 or later

Patches

github.com/wp-graphql/wp-graphql/commit/3fb1904acff4df00287ef6278fe40438d276a9f9
github.com/wp-graphql/wp-graphql/commit/bb4f778cae04f60c40bbcb1c80bed4faf91ad836

Vendor advisories

github.com/wp-graphql/wp-graphql/security/advisories/GHSA-r7m4-3v6c-3435
github.com/wp-graphql/wp-graphql/releases/tag/wp-graphql%2Fv2.24.2

Affected products

Product	Affected versions	Fixed in
WPGraphQL WPGraphQL	v < 2.24.2	2.24.2

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.