Vulnerability record/PUBLISHED/Published Nov 15, 2026 06:00:07 UTC
CVE-2026-123707
The WPGraphQL WordPress plugin before 2.27.1 does not restrict access to posts in custom non-public post statuses, allowing users with the Contributor role and above to read the content of other users' posts in those statuses.
Base scoreN/A/ 10
SeverityNoneCVSS unscored
Exploitability / impact
CVSS metric breakdown
Base severityNone
No CVSS vector is available for this record.
CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityWPScan
Last updatedNov 15, 2026 06:00:07 UTC
PublishedNov 15, 2026 06:00:07 UTC
ReservedNov 6, 2026 09:57:43 UTC
Credits
- Aabideen Bangash
- WPScan