The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled.
Log in to view the POC file snapshot cached by Shenlong Bot
Log in to view