WPGraphQL CVE-2026-119702

Exploitation requires the WPGraphQL plugin (≤2.24.0) exposed on a reachable GraphQL endpoint AND the site configured to allow anonymous comments (WordPress 'comment_registration' option disabled) - the advisory states the entire surface is reachable without logging in only on such sites. The attacker must also know or enumerate a target post ID, which the vulnerable mutation itself facilitates because non-existent, hidden, and comment-closed posts each returned distinguishable responses. The primary disclosure (post title leakage) further depends on the moderator notification email being enabled, which is WordPress default behaviour. The key LIMITING factor is comment configuration: on sites that require registration/login to comment, unauthenticated exploitation is blocked, and the only complete fix per the vendor is updating to 2.24.1 (disabling comments site-wide is the only configuration workaround and sacrifices comments).

This is a genuine but moderate-priority information-disclosure and integrity issue rather than a critical remote-code-execution threat. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw, which sounds alarming, but the impact metrics are deliberately modest: only Low confidentiality and Low integrity, with no availability impact (VC:L/VI:L/VA:N), yielding a 6.9 medium score. The most meaningful real-world impact confirmed by the GHSA advisory is disclosure of titles of unpublished (draft/private) posts via the moderator notification email, plus post-ID enumeration across statuses and forgeable comment date/type metadata - none of which grants data modification beyond inserting moderation-queue comments. No EPSS score was supplied, so statistical exploitation likelihood cannot be assessed. The CVE is NOT in CISA KEV and there is no confirmed public exploit, so there is no evidence of active exploitation. The vuln.today decision label is 'this_month', consistent with a patch-on-normal-cycle priority rather than an emergency. One important nuance: exploitation is gated by site configuration - the advisory explicitly states the full surface is only reachable without login on a site that allows anonymous comments - which the bare CVSS PR:N/UI:N vector does not convey; defenders should weigh this limiting factor.

An unauthenticated attacker sends a crafted createComment GraphQL mutation to a WPGraphQL-enabled site, targeting a guessed post ID that is actually a draft or private post. Because versions ≤2.24.0 only checked that the post existed and had comments open - not whether the caller could see it - the comment is accepted and the resulting wp_notify_moderator() email leaks the hidden post's title off-site. No public exploit has been identified at time of analysis, though the mechanism is fully documented in the vendor's GHSA advisory and the fix commit.