Is CVE-2026-88974 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-88974 being exploited in the wild.

How severe is CVE-2026-88974?

Medium severity, with a CVSS score of 5.4, published 23 September 2026.

Which products and versions are affected?

wp-graphql/wp-graphql (Packagist) < 2.22.2, ECOSYSTEM:introduced=0; WPGraphQL 2.19.0.

Is there a fix for CVE-2026-88974?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-88974 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-88974?

Check whether you run wp-graphql/wp-graphql (Packagist) or WPGraphQL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-88974: WPGraphQL authorization bypass in updatePost mutation

Q: Is there a fix for CVE-2026-88974?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-88974 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-88974?

Check whether you run wp-graphql/wp-graphql (Packagist) or WPGraphQL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-88974 · Severity: medium · CVSS 5.4 · Published 2026-09-23

WPGraphQL is a WordPress plugin that exposes WordPress content and functionality via GraphQL queries. Version 2.19.0 contains an authorization flaw in the updatePost mutation that allows Contributors to publish draft posts and modify previously published posts without the required WordPress editor approval. This bypasses the standard editorial workflow, allowing any WordPress user with Contributor privileges to unilaterally publish content to the public site without review.

Technologies: wp-graphql/wp-graphql (Packagist), WPGraphQL. Vendors: Packagist, WPGraphQL.

Quick answers

Is CVE-2026-88974 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-88974 being exploited in the wild.
How severe is CVE-2026-88974?: Medium severity, with a CVSS score of 5.4, published 23 September 2026.
Which products and versions are affected?: wp-graphql/wp-graphql (Packagist) < 2.22.2, ECOSYSTEM:introduced=0; WPGraphQL 2.19.0.
Is there a fix for CVE-2026-88974?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-88974 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-88974?: Check whether you run wp-graphql/wp-graphql (Packagist) or WPGraphQL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a broken access control / authorization bypass (CWE-863) in src/Mutation/PostObjectUpdate.php. The mutation checks only collection-level edit_posts capability but fails to perform the object-level edit_post capability check that WordPress REST enforces. Additionally, the mutation does not verify publish_posts capability when a status change to "publish" is requested; instead, it passes the requested status directly to wp_update_post() without proper authorization. An authenticated Contributor can exploit this to publish their own draft posts and modify their previously published posts despite lacking publish_posts and edit_published_posts capabilities. The attack requires WordPress authentication (via Application Password, cookie, or nonce) but no additional preconditions beyond default plugin configuration.

Affected products

WPGraphQL WPGraphQL 2.19.0

Identifiers

CVE-2026-88974
GHSA-5mmc-8pc9-wggg

Timeline

2026-09-23: disclosed
other: CVE-2026-88974 assigned

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.