Authorization Bypass (IDOR) in WPGraphQL

This is my second CVE in the same ecosystem of WPGraphQL. In short an authenticated user with role Author or Contributor, can read full content of anyone's trashed posts.

While auditing the source code, I noticed how post statues are mapped to their required the capabilities. While draft, pending, and future post correctly require 'edit_others_posts' to prevent unauthorized viewing of other users content, the trash status falls back to requiring only edit_posts.

This completely bypasses the core WordPress authorization logic (where Authors and Contributors should not be able to view full restricted content of other users). Through WPGraphQL, a low-privileged user could bypass these boundaries and retrieve the full content of any trashed post.

What's the Impact?

An authenticated user can query and read the full details of trashed posts belonging to other authors or high-privilege users, violating the expected WordPress authorization boundary.

Proof of Concept

1. Create two accounts: one with the Administrator role and another with the Author or Contributor role.
2. Create and trash a post using the Administrator account.
3. Log in as the Author or Contributor and query/view the post deleted by the Administrator.

curl -X POST "<TARGET>" \
 -H "Authorization: Basic <APPLICATION PASSWORD>" \
 -H "Content-Type: application/json" \
 --data '{"query":"query GetTrashedPosts { posts(where: { status: TRASH }) { nodes { id title content status } } }"}'

curl -X POST "<TARGET>" \
 -H "Authorization: Basic <APPLICATION PASSWORD>" \
 -H "Content-Type: application/json" \
 --data '{"query":"query GetTrashedPosts { posts(where: { status: TRASH }) { nodes { id title content status } } }"}'

References

GitHub Advisory: GHSA-rq5q-mc8v-w8pq

Credits

msfire