DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-88974: CVE-2026-88974: Incorrect Authorization in WPGraphQL updatePost Mutation

#security #cve #cybersecurity

CVE-2026-88974: Incorrect Authorization in WPGraphQL updatePost Mutation

Vulnerability ID: CVE-2026-88974
CVSS Score: 5.4
Published: 2026-09-23

CVE-2026-88974 is an incorrect authorization vulnerability in the WPGraphQL plugin for WordPress. Due to a failure to perform object-level capability checks or validate status-transition requirements in the updatePost mutation handler, authenticated Contributor-level users can publish their own draft posts without editorial approval or modify their previously published posts.

TL;DR

An authorization vulnerability in WPGraphQL prior to 2.22.2 allows authenticated WordPress Contributors to bypass workflow restrictions and publish drafts or modify published posts without editorial oversight.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-863 (Incorrect Authorization)
  • Attack Vector: Network
  • CVSS v3.1 Score: 5.4
  • Exploit Status: PoC via test suite
  • Impact: Privilege Escalation / Unauthorized Publication
  • KEV Status: Not Listed

Affected Systems

  • WordPress installations with WPGraphQL plugin prior to 2.22.2
  • wp-graphql: >= 2.19.0, < 2.22.2 (Fixed in: 2.22.2)

Code Analysis

Commit: 5544166

Fix incorrect authorization issue in PostObjectUpdate mutation and address other vulnerabilities

Exploit Details

  • GitHub (WPGraphQL Test Suite): The pull request contains high-fidelity regression unit tests verifying that Contributors can no longer publish drafts or modify published posts.

Mitigation Strategies

  • Upgrade the WPGraphQL plugin to version 2.22.2 or higher.
  • Temporarily downgrade Contributor accounts to the Subscriber role to block access to post mutations.
  • Implement Web Application Firewall (WAF) rule sets to detect and block unauthorized post status updates.

Remediation Steps:

  1. Access the WordPress administrative dashboard.
  2. Navigate to the Plugins menu and locate WPGraphQL.
  3. Click 'Update Now' to apply the patch for version 2.22.2.
  4. Alternatively, execute 'wp plugin update wp-graphql' using the WordPress CLI.
  5. Review user privilege assignments and audit existing posts for unauthorized changes.

References

Read the full report for CVE-2026-88974 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)