Skip to content
OpenAdvisories

Vendor

WPGraphQL

9 known vulnerabilities.

WPGraphQL at a glance

Last 12 months
8
Critical · all time
0
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 3 5 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 2 vulnerabilities June 2026: 1 vulnerability Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 5 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202650
Sep 202600
Aug 202600
Jul 202600
Jun 202610
May 202620
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

WPGraphQL 8 WPGraphQL Smart Cache 1
All Critical High Medium Low Exploited only Public exploit

9 results · Feed

  • Medium 6.5
    CVE-2026-119702

    WPGraphQL before 2.24.1 Missing Authorization via createComment Mutation

    WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allows unauthenticated attackers to comment on non-public posts by bypassing post status checks. Attackers can attach comments to draft, private, trashed…

    WPGraphQL WPGraphQL
  • Medium 5.3
    CVE-2026-119701

    WPGraphQL before 2.24.1 Email Flooding via Aliased sendPasswordResetEmail Mutations

    WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to flood password reset emails by aliasing the sendPasswordResetEmail mutation. Attackers can send one HTTP request with many aliases, bypassing batch…

    WPGraphQL WPGraphQL
  • Medium 5.3
    CVE-2026-119699

    WPGraphQL Smart Cache before 2.3.3 Unbounded Persisted Query Storage DoS

    WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to persist unlimited query documents via the Automatic Persisted Query handler. Attackers can send distinct queries with match…

    WPGraphQL WPGraphQL Smart Cache
  • Medium 5.3
    CVE-2026-119700

    WPGraphQL before 2.24.2 Object Existence Disclosure via Media and Comment Mutations

    WPGraphQL before 2.24.2 contains an information disclosure vulnerability that allows unauthenticated attackers to determine object existence through distinct error responses. Attackers can iterate IDs against deleteMediaItem, updateMediaItem, deleteComment an…

    WPGraphQL WPGraphQL
  • Medium 5.3
    CVE-2026-109703

    WordPress WPGraphQL plugin <= 2.23.1 - Sensitive Data Exposure vulnerability

    Missing Authorization vulnerability in WPGraphQL WPGraphQL wp-graphql allows Retrieve Embedded Sensitive Data.This issue affects WPGraphQL: from n/a through 2.23.1.

    WPGraphQL WPGraphQL
  • High 7.5
    CVE-2026-40762

    WordPress WPGraphQL plugin < 2.11.1 - SQL Injection vulnerability

    Unauthenticated SQL Injection in WPGraphQL < 2.11.1 versions.

    WPGraphQL WPGraphQL
  • High 7.5
    CVE-2021-47959

    WordPress Plugin WPGraphQL 1.3.5 Denial of Service

    WordPress Plugin WPGraphQL 1.3.5 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server resources by sending batched GraphQL queries with duplicated fields. Attackers can send POST requests to the GraphQL endpoint w…

    WPGraphQL WPGraphQL Web / CMS
  • Medium 5.4
    CVE-2025-68604

    WordPress WPGraphQL plugin <= 2.5.3 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in WPGraphQL allows Cross Site Request Forgery. This issue affects WPGraphQL: from n/a through 2.5.3.

    WPGraphQL WPGraphQL
  • Medium 4.4
    CVE-2023-23684

    WordPress WPGraphQL Plugin <= 1.14.5 is vulnerable to Server Side Request Forgery (SSRF)

    Server-Side Request Forgery (SSRF) vulnerability in WPGraphQL.This issue affects WPGraphQL: from n/a through 1.14.5.

    WPGraphQL WPGraphQL wp-graphql/wp-graphql Packagist