Medium 5.4Published Sep 23, 2026

CVE-2026-88974WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost

Updated under an hour ago (2026-10-19 06:10 UTC)

Does this affect you?

It affects wp-graphql. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for wp-graphql

Exploited in the last 30 days

WPGraphQL provides a GraphQL API for WordPress sites. Prior to 2.22.2, the updatePost mutation in src/Mutation/PostObjectUpdate.php checks only the collection-level edit_posts capability and the post author, but does not enforce the object-level edit_post capability or require publish_posts for public status transitions. An authenticated Contributor can therefore publish the Contributor's own draft without editorial approval or modify the Contributor's previously published post despite lacking edit_published_posts, while posts owned by other authors remain protected. This issue is fixed in version 2.22.2.

CVSS: 5.4 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Weakness (CWE): CWE-863
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: GitHub_M
NVD analysis: Awaiting Analysis
Record last updated: Sep 23, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

wp-graphql wp-graphql wp_graphql:wp_graphql (from the name)	before 2.22.2	CNA record

References

https://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-5mmc-8pc9-wgggx-refsource-confirm
https://github.com/wp-graphql/wp-graphql/pull/4270x-refsource-misc
https://github.com/wp-graphql/wp-graphql/commit/55441663eaa33c3f2e05de038c8286c845916461x-refsource-misc
https://github.com/wp-graphql/wp-graphql/releases/tag/wp-graphql%2Fv2.22.2x-refsource-misc

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.