CVE-2026-119700
Mở trang đầy đủCVSS 5.3 MEDIUM Lộ dữ liệu
WPGraphQL before 2.24.2 Object Existence Disclosure via Media and Comment Mutations
Mô tả
WPGraphQL before 2.24.2 contains an information disclosure vulnerability that allows unauthenticated attackers to determine object existence through distinct error responses. Attackers can iterate IDs against deleteMediaItem, updateMediaItem, deleteComment and updateComment mutations to discover hidden draft, private, trashed posts, custom post types, and unapproved comments.
Điểm và phân loại
- CVSS
- 5.3 MEDIUM v3.1
- Nguồn điểm
- NVD
- Mức độ (theo nguồn)
- MEDIUM
- EPSS
- —
- CWE
- CWE-204
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Ảnh hưởng
Sản phẩm
- WPGraphQL WPGraphQL
Vì sao bị lọc
- CVSS 5.3 < 8.0 và không thuộc CISA KEV
Loại tác động
- Lộ dữ liệu
- từ khoá "information disclosure"
Dữ liệu riêng của nguồn
- CVE.org · Đơn vị cấp mã
- VulnCheck
Tham khảo
- https://github.com/wp-graphql/wp-graphql
- https://github.com/wp-graphql/wp-graphql/blob/wp-graphql/v2.24.0/plugins/wp-graphql/src/Mutation/MediaItemDelete.php
- https://github.com/wp-graphql/wp-graphql/commit/3fb1904acff4df00287ef6278fe40438d276a9f9
- https://github.com/wp-graphql/wp-graphql/commit/bb4f778cae04f60c40bbcb1c80bed4faf91ad836
- https://github.com/wp-graphql/wp-graphql/releases/tag/wp-graphql%2Fv2.24.2
- https://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-r7m4-3v6c-3435
- https://www.vulncheck.com/advisories/wpgraphql-before-2.24.2-object-existence-disclosure-via-media-and-comment-mutations