Description
WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allows unauthenticated attackers to comment on non-public posts by bypassing post status checks. Attackers can attach comments to draft, private, trashed, or password-protected posts to leak hidden titles via moderator notifications, enumerate post IDs, and backdate comments or mark them as pingbacks.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
WPGraphQL WPGraphQL
Default version status: unaffected
0 to < 2.24.1affected
References
- https://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-4vgv-vvxr-9fh9 ↗
- https://github.com/wp-graphql/wp-graphql/commit/b9da32bd8e6025e19a9b04acaa129978eba71177 ↗
- https://github.com/wp-graphql/wp-graphql/blob/wp-graphql/v2.24.0/plugins/wp-graphql/src/Mutation/CommentCreate.php ↗
- https://github.com/wp-graphql/wp-graphql/releases/tag/wp-graphql%2Fv2.24.1 ↗
- https://github.com/wp-graphql/wp-graphql ↗
- https://www.vulncheck.com/advisories/wpgraphql-before-2.24.1-missing-authorization-via-createcomment-mutation ↗