Unauthorized Post Content Access in WPGraphQL Plugin

Executive Summary

This vulnerability affects the WPGraphQL WordPress plugin before version 2.27.1. Users with the Contributor role or higher can read posts in custom non-public post statuses that belong to other users. This allows unauthorized access to sensitive content.

Useful 0 Not Useful 0

Detection Guidance

Check if your WPGraphQL plugin version is below 2.27.1 by running: wp plugin list | grep wp-graphql. Inspect GraphQL queries for unauthorized access to non-public post statuses. Review user roles with Contributor access or higher for unusual activity.

Useful 0 Not Useful 0

Impact Analysis

If you use the WPGraphQL plugin before version 2.27.1, attackers with Contributor access or higher could read private posts in custom statuses. This may expose sensitive data like drafts, internal communications, or unpublished content to unauthorized users.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) by exposing private user content. Compliance risks include data breaches and unauthorized disclosure.

Useful 0 Not Useful 0

Mitigation Strategies

Update the WPGraphQL plugin to version 2.27.1 or later immediately. Temporarily restrict Contributor role permissions to limit access to sensitive posts. Monitor for unusual GraphQL queries or data access patterns.

Useful 0 Not Useful 0