WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost
Medium · CVSS 5.4
## Summary WPGraphQL 2.19.0 contains an authorization bypass in the `updatePost` mutation. An authenticated WordPress Contributor can change one of their own draft posts to `PUBLISH` despite lacking the `publish_posts` capability. The same mutation also permits the Contributor to modify their own previously published posts despite lacking `edit_published_posts` and failing WordPress's object-level `edit_post` capability check. This bypasses the standard WordPress editorial workflow. The WordPress REST API correctly rejects the equivalent operations for the same user.
Remediation
No patched version is listed in the advisory yet — follow the source advisory for mitigations and updates.
Affected PHP branches
See the source advisory.
Source: GitHub Global Security Advisories (Composer ecosystem) · retrieved 2026-10-22T10:19:14-04:00 · https://github.com/advisories/GHSA-5mmc-8pc9-wggg