Threats tagged 'ghsa-rgvw-jqg8-92x3'

WPGraphQL versions before 2.24.2 have an information disclosure vulnerability that allows unauthenticated attackers to determine the existence of certain objects. By sending requests to specific mutations such as deleteMediaItem, updateMediaItem, deleteComment, and updateComment, attackers can infer the presence of hidden draft, private, trashed posts, custom post types, and unapproved comments based on distinct error responses.