CVE-2026-119702

Name of the Vulnerable Software and Affected Versions WPGraphQL versions prior to 2.24.1

Description An authorization flaw exists in the createComment mutation. This allows unauthenticated users to bypass post status checks and add comments to non-public posts, including those that are draft, private, trashed, or password-protected. This can lead to the enumeration of post IDs, the leaking of hidden titles through moderator notifications, and the ability to backdate comments or mark them as pingbacks.

Recommendations Update WPGraphQL to version 2.24.1 or later.