
Security-research reproduction of CVE-2026-27938 / GHSA-4q9f-mjxf-rx7x (GitHub Actions expression injection in release workflows) — snapshot of wp-graphql/wp-graphql at b216fe22f3a119f256511ec7353f536fee6886ac
Automated research artifact — not the upstream project.
This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of
wp-graphql/wp-graphqlat commitb216fe22f3a119f256511ec7353f536fee6886ac(2026-02-20), redistributed under that project's own licence, whose file is included unchanged in this snapshot.The upstream project is not involved, is never targeted, and the vulnerability studied here is already public. Every secret and variable in this repository is a randomly generated dummy value — no real credential is present. Action references and runner images are pinned to what they resolved to on 2026-02-20; see
pinning.mdin the harness output for every change made to the snapshot.Questions or objections: [email protected]
Unlock the power of WordPress data with GraphQL
WPGraphQL provides an extendable GraphQL API for any WordPress site, unlocking modern development workflows.
Whether you're a WordPress developer exploring GraphQL or a GraphQL expert diving into WordPress, WPGraphQL simplifies data interaction and empowers your development workflow.
This is a monorepo containing the WPGraphQL ecosystem of plugins and websites:
wp-graphql/
├── plugins/
│ ├── wp-graphql/ # WPGraphQL core plugin
│ ├── wp-graphql-ide/ # IDE extension plugin
│ └── wp-graphql-smart-cache/ # Smart Cache extension plugin
├── websites/
│ └── wpgraphql.com/ # WPGraphQL.com Next.js website
├── .wp-env.json # Shared WordPress environment config
├── package.json # Root workspace configuration
└── turbo.json # Turborepo build orchestration
For end users: Nothing changes! Install WPGraphQL from WordPress.org, Composer, or download the release zip.
For contributors: Clone the repo and run:
npm install # Install dependencies (uses workspaces)
npm run wp-env start # Start WordPress environment with all plugins
📚 See the Development Guide for detailed setup instructions.
WPGraphQL aims to be the canonical GraphQL API for WordPress, providing:
In scope:
Candidates for core (via Experiments):
Better as extensions:
The difference: Experiments are potential core features being validated. Extensions are intentionally separate functionality that should remain as plugins. Experiments may graduate to core or be removed; extensions live independently forever.
This focus keeps WPGraphQL maintainable while enabling a rich ecosystem of extensions.
wp plugin install wp-graphql --activateregister_graphql_field and register_graphql_connection.

For Users:
For Contributors:
WPGraphQL is powered by a passionate community of contributors, backers, and sponsors.
Want to help maintain and grow WPGraphQL?
We extend our gratitude to the following projects and organizations for their contributions to the WordPress and GraphQL ecosystems:
graphql-php library that powers WPGraphQL's core functionality.graphql-relay-php library used in relay connections.Thank you to all these organizations and individuals for their efforts in shaping the tools we rely on today.
WPGraphQL is becoming a Canonical Plugin on WordPress.org, ensuring long-term support and a growing community of users and contributors.
WPGraphQL uses the Appsero SDK to collect telemetry data only after user consent, helping us improve the plugin responsibly.