{"id":"CVE-2026-119700","aliases":[],"cve":{"records":[{"id":"CVE-2026-119700","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-30T14:49:21.109Z","published":"2026-10-30T15:16:01.901Z","modified":"2026-11-05T21:39:55.168Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-10-30T15:19:18.275Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-05T21:39:55.168Z"}],"references":[{"url":"https://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-r7m4-3v6c-3435","tags":["vendor-advisory"],"source":"VulnCheck"},{"url":"https://github.com/wp-graphql/wp-graphql/commit/3fb1904acff4df00287ef6278fe40438d276a9f9","tags":["patch"],"source":"VulnCheck"},{"url":"https://github.com/wp-graphql/wp-graphql/commit/bb4f778cae04f60c40bbcb1c80bed4faf91ad836","tags":["patch"],"source":"VulnCheck"},{"url":"https://github.com/wp-graphql/wp-graphql/blob/wp-graphql/v2.24.0/plugins/wp-graphql/src/Mutation/MediaItemDelete.php","tags":["technical-description"],"source":"VulnCheck"},{"url":"https://github.com/wp-graphql/wp-graphql/releases/tag/wp-graphql%2Fv2.24.2","tags":["release-notes"],"source":"VulnCheck"},{"url":"https://github.com/wp-graphql/wp-graphql","tags":["product"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/wpgraphql-before-2.24.2-object-existence-disclosure-via-media-and-comment-mutations","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-204","description":"Observable Response Discrepancy","source":"VulnCheck"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-05T21:39:36.594612Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"title":"WPGraphQL before 2.24.2 Object Existence Disclosure via Media and Comment Mutations","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"WPGraphQL before 2.24.2 contains an information disclosure vulnerability that allows unauthenticated attackers to determine object existence through distinct error responses. Attackers can iterate IDs against deleteMediaItem, updateMediaItem, deleteComment and updateComment mutations to discover hidden draft, private, trashed posts, custom post types, and unapproved comments.","score":6.9,"severity":"medium","published":"2026-10-30T15:16:01.901Z","modified":"2026-11-05T21:39:55.168Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"WPGraphQL","name":"WPGraphQL","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"2.24.2","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-119700"}],"remediation":[],"references":["https://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-r7m4-3v6c-3435","https://github.com/wp-graphql/wp-graphql/commit/3fb1904acff4df00287ef6278fe40438d276a9f9","https://github.com/wp-graphql/wp-graphql/commit/bb4f778cae04f60c40bbcb1c80bed4faf91ad836","https://github.com/wp-graphql/wp-graphql/blob/wp-graphql/v2.24.0/plugins/wp-graphql/src/Mutation/MediaItemDelete.php","https://github.com/wp-graphql/wp-graphql/releases/tag/wp-graphql%2Fv2.24.2","https://github.com/wp-graphql/wp-graphql","https://www.vulncheck.com/advisories/wpgraphql-before-2.24.2-object-existence-disclosure-via-media-and-comment-mutations"],"sources":[{"name":"CVE","id":"CVE-2026-119700","modified":"2026-11-05T21:39:55.168Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-119700"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","score":6.9},{"source":"VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3}],"sourceAffected":[],"observedAt":"2026-11-05T22:38:37.188Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T23:30:30.969Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-06T04:40:37.517Z","attemptedAt":"2026-11-06T04:40:37.517Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-06T04:50:32.083Z","attemptedAt":"2026-11-06T04:50:32.083Z"},{"source":"EUVD","status":"refresh-failed","attemptedAt":"2026-11-06T04:45:31.556Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-06T04:40:37.286Z","attemptedAt":"2026-11-06T04:40:37.286Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-119700","url":"https://www.first.org/epss/","probability":0.00363,"percentile":0.30322,"date":"2026-11-05","checkedAt":"2026-11-06T04:40:37.286Z"},{"source":"NVD","id":"CVE-2026-119700","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119700","modified":"2026-11-05T22:17:52.557","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-11-06T04:40:37.517Z"},{"source":"NVD","id":"CVE-2026-119700","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119700","modified":"2026-11-05T22:17:52.557","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","checkedAt":"2026-11-06T04:40:37.517Z"},{"source":"GitHub Advisory Database","id":"GHSA-rgvw-jqg8-92x3","url":"https://github.com/advisories/GHSA-rgvw-jqg8-92x3","modified":"2026-10-30T18:32:45Z","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","checkedAt":"2026-11-06T04:50:32.083Z"}],"aiSummary":{"text":"WPGraphQL before 2.24.2 has an information disclosure vulnerability, allowing unauthenticated attackers to determine object existence via distinct error responses in media and comment mutations. Attackers can discover hidden posts and comments by iterating IDs. The weakness is an observable response discrepancy.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-31T13:46:05.301Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-119700"}]}}