https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-02T06:05:44.622683+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-119702 fkie_cve-2026-119702 2026-11-02T06:05:44.640281+00:00

WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allows unauthenticated attackers to comment on non-public posts by bypassing post status checks. Attackers can attach comments to draft, private, trashed, or password-protected posts to leak hidden titles via moderator notifications, enumerate post IDs, and backdate comments or mark them as pingbacks.

 https://db.gcve.eu/vuln/ghsa-wj7h-xjr7-93c6 GHSA-wj7h-xjr7-93c6 2026-11-02T06:05:44.640353+00:00

WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allows unauthenticated attackers to comment on non-public posts by bypassing post status checks. Attackers can attach comments to draft, private, trashed, or password-protected posts to leak hidden titles via moderator notifications, enumerate post IDs, and backdate comments or mark them as pingbacks.