CVE-2026-27938 | wp-graphql up to 2.9.0 release.yml os command injection (GHSA-4q9f-mjxf-rx7x)
A vulnerability marked as critical has been reported in wp-graphql up to 2.9.0. The affected element is an unknown function of the file release.yml. Performing a manipulation results in os command injection.
This vulnerability is known as CVE-2026-27938. Remote exploitation of the attack is possible. No exploit is available.
It is suggested to upgrade the affected component.