WPGraphQL’s updatePost mutation verified only a global edit_posts capability and the post author, omitting the finer‐grained object‑level edit_post check and the requirement for publish_posts to change a post’s status to public. Consequently, a user assigned the Contributor role could publish their own draft posts or alter a previously published post that they owned, while posts belonging to other authors remained protected. This flaw is a manifestation of CWE‑863, representing a missing authorization check that allows users to act beyond their intended privileges.

The vulnerability affects the WPGraphQL WordPress plugin, vendor wp‑graphql, for all releases prior to version 2.22.2. Site operators using any plugin installation that has not yet been updated to 2.22.2 or newer are potentially impacted.

The CVSS score of 5.4 indicates moderate severity. Exploitation requires an authenticated Contributor account; the attack vector is limited to users who already have contributor access, so generic public exposure is not a factor, but the risk remains significant for sites relying on stricter editorial workflows. EPSS data is unavailable and the issue is not listed in CISA’s KEV catalog, suggesting limited active exploitation. Nonetheless, the ability to publish content without editorial approval can lead to defacement or misinformation on the site.