---
id: CVE-2026-119700
title: >-
  WPGraphQL before 2.24.2 Object Existence Disclosure via Media and Comment
  Mutations
summary: >-
  WPGraphQL before 2.24.2 contains an information disclosure vulnerability that
  allows unauthenticated attackers to determine object existence through
  distinct error responses. Attackers can iterate IDs against deleteMediaItem,
  updateMedia…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-204
vendor: WPGraphQL
product: WPGraphQL
affected:
  - WPGraphQL < 2.24.2
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-05T21:39:36.594612Z'
published: '2026-10-30'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:39:55.168Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119700'
references:
  - url: >-
      https://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-r7m4-3v6c-3435
    label: GitHub Security Advisory (GHSA-r7m4-3v6c-3435)
  - url: >-
      https://github.com/wp-graphql/wp-graphql/commit/3fb1904acff4df00287ef6278fe40438d276a9f9
  - url: >-
      https://github.com/wp-graphql/wp-graphql/commit/bb4f778cae04f60c40bbcb1c80bed4faf91ad836
  - url: >-
      https://github.com/wp-graphql/wp-graphql/blob/wp-graphql/v2.24.0/plugins/wp-graphql/src/Mutation/MediaItemDelete.php
  - url: 'https://github.com/wp-graphql/wp-graphql/releases/tag/wp-graphql%2Fv2.24.2'
    label: WPGraphQL wp-graphql/v2.24.2 Release Notes
  - url: 'https://github.com/wp-graphql/wp-graphql'
  - url: >-
      https://www.vulncheck.com/advisories/wpgraphql-before-2.24.2-object-existence-disclosure-via-media-and-comment-mutations
    label: >-
      VulnCheck Advisory: WPGraphQL before 2.24.2 Object Existence Disclosure
      via Media and Comment Mutations
tags:
  - cve.org
epss: 0.00363
epssPercentile: 0.30322
ingestedAt: '2026-11-05T16:07:30.401Z'
---

## Overview

WPGraphQL before 2.24.2 contains an information disclosure vulnerability that allows unauthenticated attackers to determine object existence through distinct error responses. Attackers can iterate IDs against deleteMediaItem, updateMediaItem, deleteComment and updateComment mutations to discover hidden draft, private, trashed posts, custom post types, and unapproved comments.

## Affected

- `WPGraphQL < 2.24.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.