Description
WPGraphQL before 2.24.2 contains an information disclosure vulnerability that allows unauthenticated attackers to determine object existence through distinct error responses. Attackers can iterate IDs against deleteMediaItem, updateMediaItem, deleteComment and updateComment mutations to discover hidden draft, private, trashed posts, custom post types, and unapproved comments.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
WPGraphQL WPGraphQL
Default version status: unaffected
0 to < 2.24.2affected
References
- https://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-r7m4-3v6c-3435 ↗
- https://github.com/wp-graphql/wp-graphql/commit/3fb1904acff4df00287ef6278fe40438d276a9f9 ↗
- https://github.com/wp-graphql/wp-graphql/commit/bb4f778cae04f60c40bbcb1c80bed4faf91ad836 ↗
- https://github.com/wp-graphql/wp-graphql/blob/wp-graphql/v2.24.0/plugins/wp-graphql/src/Mutation/MediaItemDelete.php ↗
- https://github.com/wp-graphql/wp-graphql/releases/tag/wp-graphql%2Fv2.24.2 ↗
- https://github.com/wp-graphql/wp-graphql ↗
- https://www.vulncheck.com/advisories/wpgraphql-before-2.24.2-object-existence-disclosure-via-media-and-comment-mutations ↗