SB20260427157 - Missing Authorization in WPGraphQL
Published: April 27, 2026
Security Bulletin ID
SB20260427157
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Missing Authorization (CVE-ID: CVE-2026-33290)
The vulnerability allows a remote user to bypass comment moderation workflows.
The vulnerability exists due to missing authorization in the updateComment mutation when processing comment status updates from a comment owner. A remote user can submit a crafted GraphQL mutation to bypass comment moderation workflows.
The issue affects changes to the moderation state of the user's own comment, including setting the status to approve without the moderate_comments capability.
Remediation
Install update from vendor's website.