IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
Sin puntuación

CVE-2026-123707WPGraphQL < 2.27.1 - Contributor+ Custom Post Status Content Disclosure

WPGraphQL Publicada: (hace 1 hora)

Descripción

The WPGraphQL WordPress plugin before 2.27.1 does not restrict access to posts in custom non-public post statuses, allowing users with the Contributor role and above to read the content of other users' posts in those statuses.

Debilidad (CWE): CWE-200

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
— WPGraphQL < 2.27.1

Referencias y parches

CVE recientes del mismo producto — WordPress plugins & themes

Sin puntuación
CVE-2026-127048

Lazy Blocks < 3.0.0 - Unauthenticated RCE

Custom Block Builder

The Custom Block Builder WordPress plugin before 3.0.0 does not properly deny unauthorised requests to its REST routes, as its permission checks return a non-error response that WordPress treats as granted, allowing unauthenticated users to execute arbitrary…