CVE-2026-88974

## Summary WPGraphQL 2.19.0 contains an authorization bypass in the `updatePost` mutation. An authenticated WordPress Contributor can change one of their own draft posts to `PUBLISH` despite lacking the `publish_posts` capability. The same mutation also permits the Contributor to modify their own previously published posts despite lacking `edit_published_posts` and failing WordPress's object-level `edit_post` capability check. This bypasses the standard WordPress editorial workflow. The WordPress REST API correctly rejects the equivalent operations for the same user. ## Affected software - Plugin: WPGraphQL - Plugin slug: `wp-graphql` - Confirmed affected version: `2.19.0` - Plugin URL: https://wordpress.org/plugins/wp-graphql/ - Repository: https://github.com/wp-graphql/wp-graphql - WordPress version used for testing: `7.0.2` - WPGraphQL configuration: default settings Only version 2.19.0 is claimed as confirmed because that is the version tested. The same authorization pattern appears in earlier source history, but those releases were not independently tested. ## Vulnerability type - Broken access control / authorization bypass - CWE-863: Incorrect Authorization - OWASP 2021: A01 – Broken Access Control - Minimum required role: Contributor ## Technical cause `src/Mutation/PostObjectUpdate.php` checks only the post type's collection-level `edit_posts` capability: ```php if ( ! isset( $post_type_object->cap->edit_posts ) || ! current_user_can( $post_type_object->cap->edit_posts ) ) { // Reject request. } ``` It separately prevents a user from changing another author's post, but it does not perform WordPress's object-level check: ```php current_user_can( $post_type_object->cap->edit_post, $post_id ) ``` It also does not check `publish_posts` when the requested update changes the post status to `publish`. The mutation passes the requested status directly to `wp_update_post()`, which expects its caller to have already enforced authorization. By compar