CVE-2026-88974
Received Received - Intake

Unauthorized Post Status Change in WPGraphQL

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: GitHub, Inc.

Description
WPGraphQL provides a GraphQL API for WordPress sites. Prior to 2.22.2, the updatePost mutation in src/Mutation/PostObjectUpdate.php checks only the collection-level edit_posts capability and the post author, but does not enforce the object-level edit_post capability or require publish_posts for public status transitions. An authenticated Contributor can therefore publish the Contributor's own draft without editorial approval or modify the Contributor's previously published post despite lacking edit_published_posts, while posts owned by other authors remain protected. This issue is fixed in version 2.22.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-88974
EUVD
EUVD-2026-85310

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
wpgraphql wpgraphql to 2.22.2 (exc)
wpgraphql wpgraphql 2.21.1
wpgraphql wpgraphql 2.22.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects WPGraphQL for WordPress versions prior to 2.22.2. It allows an authenticated Contributor to publish or modify their own posts without proper editorial approval. The updatePost mutation fails to enforce object-level capability checks like edit_post or publish_posts, bypassing WordPress's standard authorization workflows.

Detection Guidance

To detect this vulnerability, check the installed version of WPGraphQL on your WordPress site. If the version is below 2.22.2, the site is vulnerable. You can use the WordPress admin dashboard or run a command like 'wp plugin list' in the WordPress root directory to check the version.

Impact Analysis

An attacker with a Contributor role could publish unauthorized drafts, modify previously approved posts, or remove approved content from public view. This bypasses WordPress's built-in restrictions, potentially allowing unauthorized content changes without editorial oversight.

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized content modifications, potentially violating integrity and availability requirements in GDPR or HIPAA. Unauthorized publishing or editing of posts may lead to data integrity issues or unauthorized disclosure.

Mitigation Strategies

Immediately update WPGraphQL to version 2.22.2 or later. This can be done via the WordPress admin dashboard under 'Plugins' or by using the command 'wp plugin update wpgraphql' if using WP-CLI. Ensure object-level capability checks are enforced for post updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88974. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart