Executive brief
WPGraphQL is a WordPress plugin that exposes WordPress content and functionality via GraphQL queries. Version 2.19.0 contains an authorization flaw in the updatePost mutation that allows Contributors to publish draft posts and modify previously published posts without the required WordPress editor approval. This bypasses the standard editorial workflow, allowing any WordPress user with Contributor privileges to unilaterally publish content to the public site without review.
Technical details
The vulnerability is a broken access control / authorization bypass (CWE-863) in src/Mutation/PostObjectUpdate.php. The mutation checks only collection-level edit_posts capability but fails to perform the object-level edit_post capability check that WordPress REST enforces. Additionally, the mutation does not verify publish_posts capability when a status change to "publish" is requested; instead, it passes the requested status directly to wp_update_post() without proper authorization. An authenticated Contributor can exploit this to publish their own draft posts and modify their previously published posts despite lacking publish_posts and edit_published_posts capabilities. The attack requires WordPress authentication (via Application Password, cookie, or nonce) but no additional preconditions beyond default plugin configuration.
Affected products
- WPGraphQL WPGraphQL 2.19.0
Timeline
- 2026-09-23: disclosed
- other: CVE-2026-88974 assigned