CVE-2026-88974

CVE-2026-88974 · WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost

Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.

WPGraphQL provides a GraphQL API for WordPress sites. Prior to 2.22.2, the updatePost mutation in src/Mutation/PostObjectUpdate.php checks only the collection-level edit_posts capability and the post author, but does not enforce the object-level edit_post capability or require publish_posts for public status transitions. An authenticated Contributor can therefore publish the Contributor's own draft without editorial approval or modify the Contributor's previously published post despite lacking edit_published_posts, while posts owned by other authors remain protected. This issue is fixed in version 2.22.2.

CVSS 5.4 · Mittel · EPSS 0,4%

Veröffentlicht: 2026-09-23T14:11:06.092Z
Aktualisiert: 2026-09-23T16:21:35.694Z

Technologie-Stack: php

Betroffene Produkte und Versionen

wp-graphql
Softwareversionen
- < 2.22.2: Betroffen
Keine Korrektur veröffentlicht
wp-graphql/wp-graphql Packagist
Softwareversionen
- 0.0.2
- 0.0.20
- 0.0.21
- 0.0.22
- 0.0.23
- 0.0.24
- 0.0.25
- 0.0.26
- 0.0.27
- 0.0.28
- 0.0.29
- 0.0.3
- 0.0.30
- 0.0.31
- 0.0.5
- 1.2.2
- 1.27.2
- v0.0.10
- v0.0.11
- v0.0.12
- v0.0.13
- v0.0.14
- v0.0.15
- v0.0.16
- v0.0.17
- v0.0.18
- v0.0.19
- v0.0.32
- v0.0.33
- v0.0.34
- v0.0.6
- v0.0.7
- v0.0.8
- v0.0.9
- v0.1.0
- v0.1.1
- v0.1.2
- v0.1.3
- v0.1.4
- v0.10.0
- v0.10.1
- v0.10.2
- v0.10.3
- v0.11.0
- v0.12.0
- v0.12.1
- v0.12.2
- v0.12.3
- v0.13.0
- v0.13.1
- v0.13.2
- v0.13.3
- v0.14.0
- v0.15.0
- v0.15.1
- v0.15.2
- v0.15.3
- v0.15.4
- v0.15.5
- v0.15.6
- v0.2.0
- v0.2.1
- v0.2.2
- v0.2.3
- v0.3.0
- v0.3.01
- v0.3.2
- v0.3.3
- v0.3.4
- v0.3.5
- v0.3.6
- v0.3.7
- v0.3.8
- v0.4.0
- v0.4.1
- v0.4.2
- v0.4.3
- v0.5.0
- v0.5.1
- v0.6.0
- v0.6.1
- v0.6.2
- v0.6.3
- v0.7.0
- v0.7.1
- v0.8.0
- v0.8.1
- v0.8.2
- v0.8.3
- v0.8.4
- v0.9.0
- v0.9.1
- v1.0
- v1.0.1
- v1.0.2
- v1.0.3
- v1.0.4
- v1.0.5
- v1.1.0
- v1.1.1
- v1.1.2
- v1.1.3
- v1.1.4
- v1.1.5
- v1.1.6
- v1.1.7
- v1.1.8.0
- v1.10.0
- v1.11.0
- v1.11.1
- v1.11.2
- v1.11.3
- v1.12.0
- v1.12.1
- v1.12.2
- v1.12.3
- v1.13.0
- v1.13.1
- v1.13.10
- v1.13.2
- v1.13.3
- v1.13.4
- v1.13.5
- v1.13.6
- v1.13.7
- v1.13.8
- v1.13.9
- v1.14.0
- v1.14.10
- v1.14.2
- v1.14.3
- v1.14.4
- v1.14.5
- v1.14.6
- v1.14.7
- v1.14.8
- v1.14.9
- v1.15.0
- v1.16.0
- v1.17.0
- v1.18.0
- v1.18.1
- v1.18.2
- v1.19.0
- v1.2.0
- v1.2.1
- v1.2.3
- v1.2.4
- v1.2.5
- v1.2.6
- v1.20.0
- v1.21.0
- v1.22.0
- v1.22.1
- v1.23.0
- v1.24.0
- v1.25.0
- v1.26.0
- v1.27.0
- v1.27.1
- v1.28.0
- v1.28.1
- v1.29.0
- v1.29.1
- v1.29.2
- v1.29.3
- v1.3.0
- v1.3.1
- v1.3.10
- v1.3.2
- v1.3.3
- v1.3.4
- v1.3.5
- v1.3.6
- v1.3.7
- v1.3.8
- v1.3.9
- v1.30.0
- v1.31.0
- v1.31.1
- v1.32.0
- v1.32.1
- v1.4.0
- v1.4.1
- v1.4.2
- v1.4.3
- v1.4.7
- v1.5.0
- v1.5.1
- v1.5.2
- v1.5.3
- v1.5.4
- v1.5.5
- v1.5.6
- v1.5.7
- v1.5.8
- v1.5.9
- v1.6.0
- v1.6.1
- v1.6.10
- v1.6.11
- v1.6.12
- v1.6.2
- v1.6.3
- v1.6.4
- v1.6.5
- v1.6.6
- v1.6.7
- v1.6.8
- v1.6.9
- v1.7.0
- v1.7.1
- v1.7.2
- v1.8.0
- v1.8.1
- v1.8.2
- v1.8.3
- v1.8.4
- v1.8.5
- v1.8.6
- v1.8.7
- v1.9.0
- v1.9.1
- v2.0.0
- v2.0.0-beta.1
- v2.0.0-beta.2
- v2.1.0
- v2.1.1
- v2.2.0
- v2.3.0
- v2.3.3
- v2.3.6
- v2.3.8
- v2.5.0
- v2.5.1
- v2.5.2
- v2.5.3
- v2.5.4
- v2.6.0
Betroffene Versionsbereiche
- ECOSYSTEM: (−∞, +∞)
Keine Korrektur veröffentlicht

Originalquellen

Prüfen Sie Ihren Server →

CVE-2026-88974 · WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost

Betroffene Produkte und Versionen

wp-graphql

wp-graphql/wp-graphql Packagist

Originalquellen