# CVE-2026-88974: WPGraphQL authorization bypass in updatePost mutation

Source: https://junglewise.ai/threats/cve-2026-88974-wpgraphql-authorization-bypass-in-updatepost-mutation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-23. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-88974 · Severity: medium · CVSS 5.4 · Published 2026-09-23

WPGraphQL is a WordPress plugin that exposes WordPress content and functionality via GraphQL queries. Version 2.19.0 contains an authorization flaw in the updatePost mutation that allows Contributors to publish draft posts and modify previously published posts without the required WordPress editor approval. This bypasses the standard editorial workflow, allowing any WordPress user with Contributor privileges to unilaterally publish content to the public site without review.

Technologies: [wp-graphql/wp-graphql (Packagist)](https://junglewise.ai/threats/technologies/wp-graphql-wp-graphql), [WPGraphQL](https://junglewise.ai/threats/technologies/wpgraphql). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [WPGraphQL](https://junglewise.ai/threats/vendors/wpgraphql).

## Quick answers

**Is CVE-2026-88974 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-88974 being exploited in the wild.

**How severe is CVE-2026-88974?** Medium severity, with a CVSS score of 5.4, published 23 September 2026.

**Which products and versions are affected?** wp-graphql/wp-graphql (Packagist) < 2.22.2, ECOSYSTEM:introduced=0; WPGraphQL 2.19.0.

**Is there a fix for CVE-2026-88974?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-88974 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-88974?** Check whether you run wp-graphql/wp-graphql (Packagist) or WPGraphQL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a broken access control / authorization bypass (CWE-863) in src/Mutation/PostObjectUpdate.php. The mutation checks only collection-level edit_posts capability but fails to perform the object-level edit_post capability check that WordPress REST enforces. Additionally, the mutation does not verify publish_posts capability when a status change to "publish" is requested; instead, it passes the requested status directly to wp_update_post() without proper authorization. An authenticated Contributor can exploit this to publish their own draft posts and modify their previously published posts despite lacking publish_posts and edit_published_posts capabilities. The attack requires WordPress authentication (via Application Password, cookie, or nonce) but no additional preconditions beyond default plugin configuration.

## Affected products

- WPGraphQL WPGraphQL 2.19.0

## Identifiers

- CVE-2026-88974
- GHSA-5mmc-8pc9-wggg

## Timeline

- 2026-09-23: disclosed
- other: CVE-2026-88974 assigned

## Related threats

- [WPGraphQL createComment mutation missing authorization](https://junglewise.ai/threats/cve-2026-119702-wpgraphql-before-2-24-1-contains-a-missing-authorization)
- [WPGraphQL missing rate limiting in password reset email mutation](https://junglewise.ai/threats/cve-2026-119701-wpgraphql-before-2-24-1-contains-a-missing-rate-limiting)
- [WPGraphQL user enumeration in SendPasswordResetEmail mutation](https://junglewise.ai/threats/cve-2026-54768-wpgraphql-user-enumeration-in-sendpasswordresetemail-mutation)
- [WPGraphQL SQL injection in WordPress plugin](https://junglewise.ai/threats/cve-2026-40762-wpgraphql-sql-injection-in-wordpress-plugin)
- [WPGraphQL WordPress plugin denial of service via batched queries](https://junglewise.ai/threats/cve-2021-47959-wpgraphql-wordpress-plugin-denial-of-service-via-batched-queries)