WPGraphQL vulnerabilities
CVEs whose affected-version data names the WPGraphQL package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-119701Medium· 5.3WPGraphQL before 2.24.1 Email Flooding via Aliased sendPasswordResetEmail Mutations
WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to flood password reset emails by aliasing the sendPasswordResetEmail mutation. Attackers can send one HTTP request with many al…
CVE-2026-119702Medium· 6.5WPGraphQL before 2.24.1 Missing Authorization via createComment Mutation
WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allows unauthenticated attackers to comment on non-public posts by bypassing post status checks. Attackers can attach comments to d…
CVE-2026-119700Medium· 5.3WPGraphQL before 2.24.2 Object Existence Disclosure via Media and Comment Mutations
WPGraphQL before 2.24.2 contains an information disclosure vulnerability that allows unauthenticated attackers to determine object existence through distinct error responses. Attackers can iterate IDs against deleteMediaItem, updateMedia…