Vulnerability in WPGraphQL

[ Description ]Official description

WPGraphQL before 2.24.2 contains an information disclosure vulnerability that allows unauthenticated attackers to determine object existence through distinct error responses. Attackers can iterate IDs against deleteMediaItem, updateMediaItem, deleteComment and updateComment mutations to discover hidden draft, private, trashed posts, custom post types, and unapproved comments.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• github.com/wp-graphql/wp-graphql
• github.com/wp-graphql/wp-graphql/blob/wp-graphql/v2.24.0/plugins/wp-graphql/src/Mutatio…
• github.com/wp-graphql/wp-graphql/commit/3fb1904acff4df00287ef6278fe40438d276a9f9
• github.com/wp-graphql/wp-graphql/commit/bb4f778cae04f60c40bbcb1c80bed4faf91ad836
• github.com/wp-graphql/wp-graphql/releases/tag/wp-graphql%2Fv2.24.2
• github.com/wp-graphql/wp-graphql/security/advisories/GHSA-r7m4-3v6c-3435
• www.vulncheck.com/advisories/wpgraphql-before-2.24.2-object-existence-disclosure-via-me…