WordPress Plugin Vulnerabilities

WPGraphQL < 2.27.1 - Contributor+ Custom Post Status Content Disclosure

Description

The plugin does not restrict access to posts in custom non-public post statuses, allowing users with the Contributor role and above to read the content of other users' posts in those statuses.

Proof of Concept

Affects Plugins

Plugin icon
wp-graphql
Fixed in 2.27.1

References

CVE
CVE-2026-123707

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
2.2 (low)

Miscellaneous

Original Researcher
Aabideen Bangash
Submitter
Aabideen Bangash
Submitter website
https://www.linkedin.com/in/aabideen-bangash/
Verified
Yes
WPVDB ID
ae3506eb-c023-4af6-b3c0-5c2600b2b502

Timeline

Publicly Published
2026-11-13 (about 2 days ago)
Added
2026-11-13 (about 1 day ago)
Last Updated
2026-11-13 (about 1 day ago)

Other

Published
Title
Published
2026-07-16
Title
Notifima – WooCommerce Stock Manager, Inventory Management, Waitlist < 3.1.0 - Authenticated (Subscriber+) Sensitive Information Exposure
Published
2025-07-10
Title
WoodMart < 8.2.6 - Unauthenticated Post Disclosure
Published
2026-10-30
Title
Redux Framework < 4.5.16 - Subscriber+ Sensitive Information Disclosure via Inline JavaScript on profile.php
Published
2026-11-02
Title
Post Duplicator < 3.0.17 - Contributor+ Draft and Private Post Title Disclosure
Published
2025-05-16
Title
Wise Chat < 3.3.4 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory