EUVD-2026-374217

fkie_cve-2026-88974

WPGraphQL provides a GraphQL API for WordPress sites. Prior to 2.22.2, the updatePost mutation in src/Mutation/PostObjectUpdate.php checks only the collection-level edit_posts capability and the post author, but does not enforce the object-level edit_post capability or require publish_posts for public status transitions. An authenticated Contributor can therefore publish the Contributor's own draft without editorial approval or modify the Contributor's previously published post despite lacking edit_published_posts, while posts owned by other authors remain protected. This issue is fixed in version 2.22.2.

GHSA-5mmc-8pc9-wggg — WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost

Affected: Packagist: wp-graphql/wp-graphql

## Summary

WPGraphQL 2.19.0 contains an authorization bypass in the `updatePost` mutation. An authenticated WordPress Contributor can change one of their own draft posts to `PUBLISH` despite lacking the `publish_posts` capability. The same mutation also permits the Contributor to modify their own previously published posts despite lacking `edit_published_posts` and failing WordPress's object-level `edit_post` capability check.

This bypasses the standard WordPress editorial workflow. The WordPress REST API correctly rejects the equivalent operations for the same user.

## Affected software

- Plugin: WPGraphQL - Plugin slug: `wp-graphql` - Confirmed affected version: `2.19.0` - Plugin URL: https://wordpress.org/plugins/wp-graphql/ - Repository: https://github.com/wp-graphql/wp-graphql - WordPress version used for testing: `7.0.2` - WPGraphQL configuration: default settings

Only version 2.19.0 is claimed as confirmed because that is the version tested. The same authorization pattern appears in earlier source history, but those releases were not independently tested.

## Vulnerability type

- Broken access control / authorization bypass - CWE-863: Incorrect Authorization - OWASP 2021: A01 – Broken Access Control - Minimum required role: Contributor

## Technical cause

`src/Mutation/PostObjectUpdate.php` checks only the post type's collection-level `edit_posts` capability:

```php if ( ! isset( $post_type_object->cap->edit_posts ) || ! current_user_can( $post_type_object->ca…

Most recent entries from all

EUVD-2026-374217

fkie_cve-2026-88974

GHSA-5mmc-8pc9-wggg — WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost