Security readout for executives and security teams
Plain-English summary
CVE-2026-27938 affects the WPGraphQL project’s GitHub release automation before version 2.9.1. A pull request body could be inserted into a shell command during a release workflow, potentially letting an authorized contributor run commands on the GitHub Actions runner. This is primarily a software supply-chain risk, not a direct WordPress site runtime flaw.
Executive priority
Prioritize for teams maintaining WPGraphQL code, forks, or release automation. The business risk is compromise of the build or release pipeline, which can affect software integrity. If your organization only consumes the plugin without running its GitHub workflows, urgency is lower but still verify supply-chain intake controls.
Technical view
The advisory describes CWE-78 OS command injection in wp-graphql/wp-graphql .github/workflows/release.yml. The workflow used github.event.pull_request.body directly inside a run shell block. When a develop-to-master pull request is merged, that untrusted text could execute commands on the runner. CVSS is 7.7, high, with low privileges, user interaction, high complexity, and changed scope.
Likely exposure
Exposure is most relevant to maintainers or forks using the vulnerable WPGraphQL release workflow before 2.9.1. Ordinary WPGraphQL installations are not described as directly exploitable by the sources. Organizations should assess whether they run, fork, or mirror this repository workflow and whether release automation has access to sensitive tokens or publishing credentials.
Exploitation context
Sources do not report active exploitation, and the CVE is not marked KEV. Exploitation requires control over or influence on a pull request body and the vulnerable release workflow being triggered by a merge from develop to master. Impact depends on runner permissions, available secrets, and release pipeline privileges.
Researcher notes
The vulnerability is scoped to GitHub Actions workflow command injection, not the GraphQL API itself according to provided sources. Avoid assuming web-facing exploitability. Key unknowns are real-world runner permissions, secret exposure, and whether downstream forks copied the vulnerable workflow. No public exploitation is cited in the provided bundle.
Mitigation direction
- Upgrade WPGraphQL repository content to version 2.9.1 or later.
- Review vendor advisory and the linked fixing commit for workflow changes.
- Remove direct untrusted GitHub expression use inside shell run blocks.
- Restrict GitHub Actions token and release credentials to least privilege.
- Rotate secrets if suspicious release workflow activity is found.
Validation and detection
- Confirm whether wp-graphql version or repository state is earlier than 2.9.1.
- Inspect release.yml for pull_request.body used directly in run blocks.
- Compare local workflow files with the vendor fixing commit.
- Review GitHub Actions run history around develop-to-master merges.
- Check whether runners exposed secrets or publishing credentials during affected workflows.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-78: Command execution behavior lookup
Command injection weaknesses can lead defenders to review execution techniques and command interpreter telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-27938 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.7 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N1.35.8Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.7HighVector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-4q9f-mjxf-rx7xCVE reference · x_refsource_CONFIRM
- https://github.com/wp-graphql/wp-graphql/commit/de0c2d590593f1099546ad517106e454a498bc58CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.