The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even w…

1. 2019-05-21 First public exploit (EDB-46886)
2. 2019-06-10 Published

18.35% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).

• EDB-46886 WordPress Plugin WPGraphQL 0.2.3 - Multiple Vulnerabilities webapps, 2019-05-21
• Nuclei template WPEngine WPGraphQL 0.2.3 - Unauthenticated Comment Posting nuclei detection template
• packetstormsecurity.com http://packetstormsecurity.com/files/153025/WordPress-WPGraphQL-0.2.3-Authentication-Bypass-Information-Disclosure.html referenced PoC, tagged "exploit" by a source, unverified
• pentestpartners.com https://www.pentestpartners.com/security-blog/pwning-wordpress-graphql/ referenced PoC, tagged "exploit" by a source, unverified
• github.com https://github.com/pentestpartners/snippets/blob/master/wp-graphql0.2.3_exploit.py referenced PoC, tagged "exploit" by a source, unverified

Weakness

• CWE-306 Missing Authentication for Critical Functionality

Technology feeds

• WordPress rss critical rss

• packetstormsecurity.com /files/153025/WordPress-WPGraphQL-0.2.3-Authentication-Bypass-Information-Disclosure.html

  exploit, third-party-advisory, vdb-entry

• pentestpartners.com /security-blog/pwning-wordpress-graphql/

  exploit, third-party-advisory

• github.com /pentestpartners/snippets/blob/master/wp-graphql0.2.3_exploit.py

  exploit, third-party-advisory

• wpvulndb.com /vulnerabilities/9282

  release-notes, third-party-advisory

• github.com /wp-graphql/wp-graphql/releases/tag/v0.3.0

  release-notes, third-party-advisory

• CVE List CVE-2019-9881
• NVD CVE-2019-9881

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.