WPGraphQL EUVD-2026-114105

No special configuration beyond having a vulnerable WPGraphQL (2.24.0 or earlier, i.e. before 2.24.2) active with its GraphQL endpoint reachable, which is the default once the plugin is installed and enabled - remote unauthenticated exploitation requires no authentication, no user interaction and default settings. What LIMITS the impact: the flaw discloses only object existence, IDs and counts, never the content of the hidden posts or comments, and it writes and reads nothing. Per the advisory a residual, lower-value distinction remains for logged-in callers who hold the type-level capability (they can still tell a real media item ID from an empty one), but uploaded media already carry public URLs, so that is weak information next to the draft/private-post and unapproved-comment IDs the fix closes for anonymous callers.

This is a genuine but moderate-priority information-disclosure issue, not an emergency. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) and the GHSA/source diff agree that an unauthenticated, remote caller can reach the four mutations through the normal GraphQL endpoint, so the attack surface is real and trivially reachable. However, the vulnerable-system impact is correctly scoped to VC:L with VI:N/VA:N: the flaw leaks only object existence and IDs (a count and a set of IDs for drafts, private/pending/scheduled/trashed posts, custom post types, and unapproved comments), not their contents, and it writes and reads nothing. The signals are internally consistent and point to a reconnaissance/enablement weakness rather than direct compromise. No EPSS score and no CISA KEV entry were provided, and no public exploit code was identified in the inputs; the vuln.today decision label is 'this_month' (not act_now/emergency), which matches a low-to-moderate urgency profile. The main amplifier is chaining: harvested IDs feed follow-on attacks (the advisory cites GHSA-4vgv-vvxr-9fh9, where anonymous callers attached comments to posts they could not see, by ID). Net: patch on a routine 'this month' cadence, treating it as higher priority on sites holding sensitive unpublished content, since the count of unpublished work is itself information some operators care about.

An unauthenticated attacker sends GraphQL requests to a site running WPGraphQL 2.24.0 or earlier, iterating object IDs against the deleteMediaItem, updateMediaItem, deleteComment and updateComment mutations. Because each distinct error response reveals whether an ID holds nothing, holds a non-media object, holds a media item, or whether a comment exists, the attacker maps hidden drafts, private/trashed posts, custom post types and unapproved comments and collects their IDs for use in follow-on attacks. No public exploit code was identified in the inputs, but the low-complexity technique is described in detail in the vendor advisory.