CVE-2026-119700Medium· 5.3▾ SunlitWPGraphQL before 2.24.2 contains an information disclosure vulnerability that allows unauthenticated attackers to determine object existence through distinct error responses. Attackers can iterate IDs against deleteMediaItem, updateMedia…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.4%
WPGraphQL before 2.24.2 contains an information disclosure vulnerability that allows unauthenticated attackers to determine object existence through distinct error responses. Attackers can iterate IDs against deleteMediaItem, updateMediaItem, deleteComment and updateComment mutations to discover hidden draft, private, trashed posts, custom post types, and unapproved comments.
WPGraphQL < 2.24.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-119701Medium· 5.3WPGraphQL before 2.24.1 Email Flooding via Aliased sendPasswordResetEmail Mutations
CVE-2026-119702Medium· 6.5WPGraphQL before 2.24.1 Missing Authorization via createComment Mutation
CVE-2026-119699Medium· 5.3WPGraphQL Smart Cache before 2.3.3 Unbounded Persisted Query Storage DoS
CVE-2026-109703Medium· 5.3Missing Authorization vulnerability in WPGraphQL WPGraphQL wp-graphql allows Retrieve Embedded Sensitive Data.This issue affects WPGraphQL: from n/a through 2.23.1.
CVE-2026-100362Medium· 6.9SuiteCRM: V8 OAuth2 Username Enumeration
CVE-2026-85286Low· 3.7HomeBox: Timing Side-Channel in Login Endpoint Allows User Enumeration via Bcrypt Hashing Delay