Skip to content
OpenAdvisories

Package · Packagist

wp-graphql/wp-graphql

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • Medium 5.4
    CVE-2026-88974

    WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost

    WPGraphQL provides a GraphQL API for WordPress sites. Prior to 2.22.2, the updatePost mutation in src/Mutation/PostObjectUpdate.php checks only the collection-level edit_posts capability and the post author, but does not enforce the object-level edit_post cap…

    WPGraphQL wp-graphql wp-graphql/wp-graphql Packagist
  • Medium 6.9
    CVE-2026-54768

    WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)

    WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts through the sendPasswordResetEmail mutation and…

    WPGraphQL wp-graphql wp-graphql/wp-graphql Packagist
  • Medium 4.4
    CVE-2023-23684

    WordPress WPGraphQL Plugin <= 1.14.5 is vulnerable to Server Side Request Forgery (SSRF)

    Server-Side Request Forgery (SSRF) vulnerability in WPGraphQL.This issue affects WPGraphQL: from n/a through 1.14.5.

    WPGraphQL WPGraphQL wp-graphql/wp-graphql Packagist
  • Medium 5.3
    CVE-2019-25060

    WP-GraphQL < 0.3.5 - Improper Access Control

    The WPGraphQL WordPress plugin before 0.3.5 doesn't properly restrict access to information about other users' roles on the affected site. Because of this, a remote attacker could forge a GraphQL query to retrieve the account roles of every user on the site.

    wp-graphql/wp-graphql Web / CMS Packagist