Description
WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts through the sendPasswordResetEmail mutation and obtain public profile fields. This issue is fixed in version 2.15.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| wp-graphql | wp-graphql | < 2.15.1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | wp-graphql/wp-graphql | <= 2.6.0 | — | GHSA-jhh7-832h-f8hv |