Vulnerability Report

CVE-2026-27938

RCE

Title: OS command injection in WPGraphQL GitHub Actions workflow

RCE

Proof Of Concept

PoC Available for CVE-2026-27938

CWE Category CWE-78

Published Date Feb 26, 2026

Modified Date Apr 15, 2026

Exploit Status Available

Score 7.7 CVSS v3.1

Exploit Probability (EPSS)

1.37%

Vulnerability Summary

CVE-2026-27938: WPGraphQL provides a GraphQL API for WordPress sites. Prior to version 2.9.1, the `wp-graphql/wp-graphql` repository contains a GitHub Actions workflow (`release.yml`) vulnerable to OS command injection through direct use of `${{ github.event.pull_request.body }}` inside a `run:` shell block. When a pull request from `develop` to `master` is merged, the PR body is injected verbatim into a shell command, allowing arbitrary command execution on the Actions runner. Version 2.9.1 contains a fix for the vulnerability.

Impacted Vendors

Analysis in Progress...

Reference Links

https://github.com/wp-graphql/wp-graphql/commit/de0c2d590593f1099546ad517106e454a498bc58 https://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-4q9f-mjxf-rx7x

CVSS v3.1

Source Entity [email protected]

Severity HIGH

7.7

Attack Vector

NETWORK

Complexity

HIGH

Privileges

N/A

Interaction

REQUIRED

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

CHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2026-27938 Exploits & PoCs (Proof Of Concept)

GitHub https://github.com/pvharmo2/gha-lab-a7f6217d26

View Code

April 15, 2026 MODIFIED

Vulnerability data updated via NVD.

February 27, 2026 MODIFIED

Vulnerability data updated via NVD.

February 26, 2026 MODIFIED

Vulnerability data updated via NVD.

Attack Vector Matrix

Access Vector NETWORK

Complexity HIGH

Privileges N/A

Interaction REQUIRED

CVSS Vector String


                                    CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

Affected Stack

No specific products linked.