Wwp-graphql

Products

Exploited and recent CVEs

• CVE-2026-88974 Medium 5.4 WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost 0.4%
• CVE-2026-54768 Medium 6.9 WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design) 0.4%
• CVE-2026-33290 Medium 4.3 WPGraphQL Repo's updateComment allows low-privileged authenticated users to change comment moderation status (comment_approved) without moderate_comments permission 0.2%
• CVE-2026-27938 High 7.7 WPGraphQL Repo Vulnerable to Command Injection via Unsanitized GitHub Actions Expression in Release Workflow 0.9%