CVE-2026-119700— WPGraphQL before 2.24.2 Object Existence Disclosure via Media and Comment Mutations

Quick assessment

Copy summary Copy citation

Affected

WPGraphQL WPGraphQL

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WPGraphQL 在 2.24.2 版本之前存在信息泄露漏洞，该漏洞允许未认证的攻击者通过不同的错误响应判断对象是否存在。攻击者可以通过对 、 、 和 等突变操作（mutations）迭代尝试不同的 ID，从而发现隐藏的草稿、私密内容、已移至回收站的文章、自定义文章类型以及未经批准的评论。

CVE-2026-119700 affects WPGraphQL WPGraphQL. No confirmed in-the-wild exploitation; assess based on exposure. WPGraphQL 在 2.24.2 版本之前存在信息泄露漏洞，该漏洞允许未认证的攻击者通过不同的错误响应判断对象是否存在。攻击者可以通过对 、 、 和 等突变操作（mutations）迭代尝试不同的 ID，从而发现隐藏的草稿、私密内容、已移至回收站的文章、自定义文章类型以及未经批准的评论。 CVE-2026-119700 vulnerability details, Shenlong CVE Platform, https://cve.imfht.com/detail/CVE-2026-119700

I. Basic Information for CVE-2026-119700

Affected Products

II. Public POCs for CVE-2026-119700

III. Intelligence Information for CVE-2026-119700

Other References for CVE-2026-119700 (7)

• https://github.com/wp-graphql/wp-graphql/commit/3fb1904acff4df00287ef6278fe40438d276a9f9 patch
• https://github.com/wp-graphql/wp-graphql/blob/wp-graphql/v2.24.0/plugins/wp-graphql/src/Mutation/MediaItemDelete.php technical-description
• https://github.com/wp-graphql/wp-graphql product
• https://github.com/wp-graphql/wp-graphql/commit/bb4f778cae04f60c40bbcb1c80bed4faf91ad836 patch
• https://github.com/wp-graphql/wp-graphql/releases/tag/wp-graphql%2Fv2.24.2 release-notes
• https://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-r7m4-3v6c-3435 vendor-advisory
• https://www.vulncheck.com/advisories/wpgraphql-before-2.24.2-object-existence-disclosure-via-media-and-comment-mutations third-party-advisory

• https://www.cve.org/CVERecord?id=CVE-2026-119700

Same Patch Batch · WPGraphQL · 2026-10-30 · 4 CVEs total

IV. Related Vulnerabilities