PT-2026-66871 · WordPress · Wpgraphql
CVE-2026-54768
·
Published
2026-07-31
·
Updated
2026-07-31
CVSS v4.0
6.9
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
WPGraphQL versions 2.0.0 through 2.15.0
Description
An unauthenticated caller can distinguish existing author-class accounts and obtain public profile fields through the
sendPasswordResetEmail mutation. While the mutation is designed to prevent user enumeration by always returning a success status, a deprecated user field on the SendPasswordResetEmailPayload output type resolves to a full User object if the provided username or email corresponds to an existing author-class user, and returns null otherwise. This allows an attacker to verify registered usernames or emails and disclose public profile information such as databaseId, name, firstName, lastName, slug, description, uri, and url for users with published posts, including editors and administrators.Recommendations
Update WPGraphQL to version 2.15.1.
As a temporary mitigation, restrict access to the
sendPasswordResetEmail mutation to prevent unauthenticated user enumeration.Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Wpgraphql