PT-2022-8282 · WordPress · Wpgraphql

Rohan Pagey · Published 2022-05-09 · Updated 2022-05-17 · CVE-2019-25060

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions WPGraphQL WordPress plugin versions prior to 0.3.5

Description The issue allows a remote attacker to forge a GraphQL query and retrieve the account roles of every user on the site due to improper access restriction to user role information.

Recommendations For WPGraphQL WordPress plugin versions prior to 0.3.5, update to version 0.3.5 or later to resolve the issue. As a temporary workaround, consider restricting access to GraphQL queries to minimize the risk of exploitation.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2019-25060

GHSA-W3XG-7Q6M-3XWP

Affected Products

Wpgraphql

References · 7

• 🔥 https://github.com/wp-graphql/wp-graphql/pull/900 · Exploit
• 🔥 https://wpscan.com/vulnerability/393be73a-f8dc-462f-8670-f20ab89421fc · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-25060 · Security Note
• https://osv.dev/vulnerability/GHSA-w3xg-7q6m-3xwp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-25060 · Vendor Advisory
• https://github.com/wp-graphql/wp-graphql · Note
• https://t.me/cibsecurity/42187 · Telegram Post