CVE-2026-88974

Name of the Vulnerable Software and Affected Versions WPGraphQL versions prior to 2.22.2

Description An authorization bypass exists in the updatePost mutation within src/Mutation/PostObjectUpdate.php. The system only verifies the collection-level edit posts capability and the post author, failing to enforce the object-level edit post capability or require the publish posts capability for public status transitions. Consequently, an authenticated user with the Contributor role can publish their own draft posts without editorial approval or modify their own previously published posts, even if they lack the edit published posts permission. This bypasses the standard editorial workflow, although posts owned by other authors remain protected.

Recommendations Update WPGraphQL to version 2.22.2 or later. As a temporary workaround, restrict access to the updatePost mutation for users with the Contributor role until the update is applied.