{"id":"CVE-2026-88974","title":"WPGraphQL provides a GraphQL API for WordPress sites","summary":"WPGraphQL provides a GraphQL API for WordPress sites. Prior to 2.22.2, the updatePost mutation in src/Mutation/PostObjectUpdate.php checks only the collection-level edit_posts capability and the post author, but does not enforce the obje…","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","cwe":["CWE-863"],"vendor":"wp-graphql","product":"wp-graphql","affected":["wp-graphql < 2.22.2"],"published":"2026-09-23","updated":"2026-09-23","sourceUpdated":"2026-09-23T18:12:04.247","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88974","references":[{"url":"https://github.com/wp-graphql/wp-graphql/commit/55441663eaa33c3f2e05de038c8286c845916461","label":"security-advisories@github.com"},{"url":"https://github.com/wp-graphql/wp-graphql/pull/4270","label":"security-advisories@github.com"},{"url":"https://github.com/wp-graphql/wp-graphql/releases/tag/wp-graphql%2Fv2.22.2","label":"security-advisories@github.com"},{"url":"https://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-5mmc-8pc9-wggg","label":"security-advisories@github.com"},{"url":"https://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-5mmc-8pc9-wggg","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/advisories/GHSA-5mmc-8pc9-wggg"}],"tags":["nvd","cve.org","exploit-available","ghsa","composer"],"aliases":["GHSA-5mmc-8pc9-wggg"],"ecosystem":"composer","exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-23T16:21:07.871440Z"},"ingestedAt":"2026-09-23T14:25:29.804Z","slug":"CVE-2026-88974","body":"## Overview\n\nWPGraphQL provides a GraphQL API for WordPress sites. Prior to 2.22.2, the updatePost mutation in src/Mutation/PostObjectUpdate.php checks only the collection-level edit_posts capability and the post author, but does not enforce the object-level edit_post capability or require publish_posts for public status transitions. An authenticated Contributor can therefore publish the Contributor's own draft without editorial approval or modify the Contributor's previously published post despite lacking edit_published_posts, while posts owned by other authors remain protected. This issue is fixed in version 2.22.2.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-88974)\n\nAffected packages:\n\n- `wp-graphql/wp-graphql < 2.22.2`\n\nSource: https://github.com/advisories/GHSA-5mmc-8pc9-wggg","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":209805,"id":"CVE-2026-88974","ts":1790184549588,"field":"exploit_available","old":"false","new":"true"}]}