CVE WATCH / VULNERABILITY DETAIL
CVE-2026-123707
UNKNOWNCVSS 0NVD feed
Published 15 November 2026 · tracked since 15 November 2026
Description
The WPGraphQL WordPress plugin before 2.27.1 does not restrict access to posts in custom non-public post statuses, allowing users with the Contributor role and above to read the content of other users' posts in those statuses.
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog