CVE-2026-88974
1 advisory.
Packagist/wp-graphql/wp-graphql CVE-2026-88974: medium 5.4, EPSS 0.27%
WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | - |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-5mmc-8pc9-wggg
- https://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-5mmc-8pc9-wggg
- https://github.com/wp-graphql/wp-graphql/pull/4270
- https://github.com/wp-graphql/wp-graphql/commit/55441663eaa33c3f2e05de038c8286c845916461
- https://github.com/wp-graphql/wp-graphql
- https://github.com/wp-graphql/wp-graphql/releases/tag/wp-graphql%2Fv2.22.2
CVE-2026-88974 · published · modified · JSON