CVE-2026-88974: WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost
WPGraphQL 2.19.0 contains an authorization bypass in the updatePost mutation. An authenticated WordPress Contributor can change one of their own draft posts to PUBLISH despite lacking the publish_posts capability. The same mutation also permits the Contributor to modify their own previously published posts despite lacking edit_published_posts and failing WordPress’s object-level edit_post capability check.
This bypasses the standard WordPress editorial workflow. The WordPress REST API correctly rejects the equivalent operations for the same user.
References
- github.com/advisories/GHSA-5mmc-8pc9-wggg
- github.com/wp-graphql/wp-graphql/commit/55441663eaa33c3f2e05de038c8286c845916461
- github.com/wp-graphql/wp-graphql/pull/4270
- github.com/wp-graphql/wp-graphql/releases/tag/wp-graphql%2Fv2.22.2
- github.com/wp-graphql/wp-graphql/security/advisories/GHSA-5mmc-8pc9-wggg
- nvd.nist.gov/vuln/detail/CVE-2026-88974
Code Behaviors & Features
Detect and mitigate CVE-2026-88974 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →