Wp-graphql WPGraphQL up to 2.22.1 on WordPress Post Object Mutation PostObjectUpdate.php updatePost privileges management

Summaryinfo

A vulnerability identified as critical has been detected in Wp-graphql WPGraphQL up to 2.22.1. This affects the function updatePost of the file src/Mutation/PostObjectUpdate.php of the component Post Object Mutation. The manipulation leads to privileges management. This vulnerability is uniquely identified as CVE-2026-88974. The attack is possible to be carried out remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Wp-graphql WPGraphQL up to 2.22.1. It has been rated as critical. This issue affects the function updatePost of the file src/Mutation/PostObjectUpdate.php of the component Post Object Mutation. The manipulation with an unknown input leads to a privileges management vulnerability. Using CWE to declare the problem leads to CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

WPGraphQL provides a GraphQL API for WordPress sites. Prior to 2.22.2, the updatePost mutation in src/Mutation/PostObjectUpdate.php checks only the collection-level edit_posts capability and the post author, but does not enforce the object-level edit_post capability or require publish_posts for public status transitions. An authenticated Contributor can therefore publish the Contributor's own draft without editorial approval or modify the Contributor's previously published post despite lacking edit_published_posts, while posts owned by other authors remain protected. This issue is fixed in version 2.22.2.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-88974 since 09/10/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1068 for this issue.

By approaching the search of inurl:src/Mutation/PostObjectUpdate.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 2.22.2 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• Wp-graphql

Name

• WPGraphQL

Version

• 2.22.0
• 2.22.1

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion