EUVD lists missing authorization in WPGraphQL createComment mutation (EUVD-2026-114107)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- WPGraphQL
- Product
- WPGraphQL
- First seen
Summary
The EUVD listing says WPGraphQL before 2.24.1 lets unauthenticated attackers comment on non-public posts by bypassing post status checks. It gives a CVSS v3.1 score of 6.9/10 and was last updated 2026-10-30.
If you use WPGraphQL
Update WPGraphQL to version 2.24.1 or later
Check whether unexpected comments appear on draft or private posts
Disable public comment access on non-public content until patched
Update WPGraphQL Smart Cache to 2.3.3 or later
Monitor persisted query storage growth
Update WPGraphQL to 2.24.2 or later
What the sources say 4
· Mastodon: “WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allows unauthenticated attackers to comment on non-public posts by bypassing post status checks.” Source
· Mastodon: “WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to flood password reset emails by aliasing the sendPasswordResetEmail mutation.” Source
· Mastodon: “WPGraphQL before 2.24.2 contains an information disclosure vulnerability that allows unauthenticated attackers to determine object existence through distinct error responses.” Source
· Mastodon: “WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to persist unlimited query documents via the Automatic Persisted Query handler.” Source