Skip to content
OpenAdvisories

Vendor

WPGraphQL

9 known vulnerabilities.

Products

WPGraphQL 8 WPGraphQL Smart Cache 1
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-119702

    WPGraphQL before 2.24.1 Missing Authorization via createComment Mutation

    WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allows unauthenticated attackers to comment on non-public posts by bypassing post status checks. Attackers can attach comments to draft, private, trashed…

    WPGraphQL WPGraphQL
  • Medium 5.3
    CVE-2026-119701

    WPGraphQL before 2.24.1 Email Flooding via Aliased sendPasswordResetEmail Mutations

    WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to flood password reset emails by aliasing the sendPasswordResetEmail mutation. Attackers can send one HTTP request with many aliases, bypassing batch…

    WPGraphQL WPGraphQL
  • Medium 5.3
    CVE-2026-119699

    WPGraphQL Smart Cache before 2.3.3 Unbounded Persisted Query Storage DoS

    WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to persist unlimited query documents via the Automatic Persisted Query handler. Attackers can send distinct queries with match…

    WPGraphQL WPGraphQL Smart Cache
  • Medium 5.3
    CVE-2026-119700

    WPGraphQL before 2.24.2 Object Existence Disclosure via Media and Comment Mutations

    WPGraphQL before 2.24.2 contains an information disclosure vulnerability that allows unauthenticated attackers to determine object existence through distinct error responses. Attackers can iterate IDs against deleteMediaItem, updateMediaItem, deleteComment an…

    WPGraphQL WPGraphQL
  • Medium 5.3
    CVE-2026-109703

    WordPress WPGraphQL plugin <= 2.23.1 - Sensitive Data Exposure vulnerability

    Missing Authorization vulnerability in WPGraphQL WPGraphQL wp-graphql allows Retrieve Embedded Sensitive Data.This issue affects WPGraphQL: from n/a through 2.23.1.

    WPGraphQL WPGraphQL
  • Medium 5.4
    CVE-2025-68604

    WordPress WPGraphQL plugin <= 2.5.3 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in WPGraphQL allows Cross Site Request Forgery. This issue affects WPGraphQL: from n/a through 2.5.3.

    WPGraphQL WPGraphQL
  • Medium 4.4
    CVE-2023-23684

    WordPress WPGraphQL Plugin <= 1.14.5 is vulnerable to Server Side Request Forgery (SSRF)

    Server-Side Request Forgery (SSRF) vulnerability in WPGraphQL.This issue affects WPGraphQL: from n/a through 1.14.5.

    WPGraphQL WPGraphQL wp-graphql/wp-graphql Packagist