https://vulnerability.circl.lu/sightings/feed 2026-09-23T23:55:19.538762+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/fd5ba2e0-a35f-47be-a7a6-42f9a6af047b/export 2026-09-23T23:55:19.562685+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "fd5ba2e0-a35f-47be-a7a6-42f9a6af047b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88974", "type": "seen", "source": "https://gist.github.com/alon710/39d3465701d68ededce1355dd7bcc16e", "content": "# CVE-2026-88974: CVE-2026-88974: Incorrect Authorization in WPGraphQL updatePost Mutation\n\n> **CVSS Score:** 5.4\n> **Published:** 2026-09-23\n> **Full Report:** https://cvereports.com/reports/CVE-2026-88974\n\n## Summary\nCVE-2026-88974 is an incorrect authorization vulnerability in the WPGraphQL plugin for WordPress. Due to a failure to perform object-level capability checks or validate status-transition requirements in the updatePost mutation handler, authenticated Contributor-level users can publish their own draft posts without editorial approval or modify their previously published posts.\n\n## TL;DR\nAn authorization vulnerability in WPGraphQL prior to 2.22.2 allows authenticated WordPress Contributors to bypass workflow restrictions and publish drafts or modify published posts without editorial oversight.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-863 (Incorrect Authorization)\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 5.4\n- **Exploit Status**: PoC via test suite\n- **Impact**: Privilege Escalation / Unauthorized Publication\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- WordPress installations with WPGraphQL plugin prior to 2.22.2\n- **wp-graphql**: >= 2.19.0, < 2.22.2 (Fixed in: `2.22.2`)\n\n## Mitigation\n\n- Upgrade the WPGraphQL plugin to version 2.22.2 or higher.\n- Temporarily downgrade Contributor accounts to the Subscriber role to block access to post mutations.\n- Implement Web Application Firewall (WAF) rule sets to detect and block unauthorized post status updates.\n\n**Remediation Steps:**\n1. Access the WordPress administrative dashboard.\n2. Navigate to the Plugins menu and locate WPGraphQL.\n3. Click 'Update Now' to apply the patch for version 2.22.2.\n4. Alternatively, execute 'wp plugin update wp-graphql' using the WordPress CLI.\n5. Review user privilege assignments and audit existing posts for unauthorized changes.\n\n## References\n\n- [GitHub Security Advisory GHSA-5mmc-8pc9-wggg](https://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-5mmc-8pc9-wggg)\n- [WPGraphQL Pull Request 4270](https://github.com/wp-graphql/wp-graphql/pull/4270)\n- [Vulnerability Fix Commit](https://github.com/wp-graphql/wp-graphql/commit/55441663eaa33c3f2e05de038c8286c845916461)\n- [WPGraphQL 2.22.2 Release](https://github.com/wp-graphql/wp-graphql/releases/tag/wp-graphql%2Fv2.22.2)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-88974) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-23T16:32:05.554728Z"} 2026-09-23T16:32:05.554728+00:00