What is the CVSS score of CVE-2026-109703?

CVE-2026-109703 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

WPGraphQL CVE-2026-109703

EUVD-2026-98343 MEDIUM

Missing Authorization (CWE-862)

2026-10-13 Patchstack

GHSA-jp44-9pjg-2xq8

WordPress Authentication Bypass Information Disclosure Wordpress Plugin Wpgraphql

5.3

CVSS 3.1 · Vendor: Patchstack

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Discover exposed WPGraphQL endpoint
Exploit

Send unauthenticated GraphQL query
Execution

Bypass missing authorization check
Impact

Retrieve embedded sensitive data

Vulnerability Assessment

Weakness	CWE CWE-862 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V8 - Authorization Authorization checks on every request MITRE ATT&CK 1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires that the WPGraphQL plugin (versions through 2.23.1) is installed and its GraphQL endpoint is network-reachable; the flaw is a missing authorization check that lets an unauthenticated requester retrieve embedded sensitive data. No authentication, no privileges, and no user interaction are needed (PR:N/UI:N), so default exposed installations are affected. Realistic limiting factors: the site must actually run WPGraphQL and expose the GraphQL endpoint publicly, and impact is bounded to LOW confidentiality (C:L) - only certain embedded data is exposed, with no integrity or availability impact; sites that restrict or firewall the GraphQL endpoint, or that have upgraded past 2.23.1, are not exposed.
Impact	This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3) describes a network-reachable, low-complexity, unauthenticated flaw with LOW confidentiality impact and no integrity or availability impact - consistent with a Missing Authorization (CWE-862) weakness that leaks embedded sensitive data via WPGraphQL's GraphQL endpoint. No EPSS score was supplied in the input, the CVE is NOT listed in CISA KEV, and no public POC is referenced, so there is no evidence of active or automated exploitation at this time. The signals are internally consistent (unauthenticated info-disclosure, bounded to limited confidentiality) rather than conflicting; the main caveat is that this is a single-source assessment (Patchstack only) with 'n/a through 2.23.1' affected-range wording that does not pin a confirmed fixed version. Treat as a routine-to-prompt patch for exposed WordPress sites running WPGraphQL rather than a drop-everything event.
Exploit ScenarioDerived	An unauthenticated attacker sends crafted GraphQL queries to a WordPress site's WPGraphQL endpoint and, because an authorization check is missing, receives embedded sensitive data that should have required privileges to read. No public exploit code is referenced, but the query is simple and requires no user interaction, so the attack is straightforward to attempt at scale against internet-facing sites.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 13, 2026

Unauthenticated retrieval of embedded sensitive data is possible on WordPress sites running the WPGraphQL plugin through version 2.23.1, because the plugin omits an authorization check on the affected GraphQL operation (CWE-862). Any network-reachable instance exposes the flaw to unauthenticated requesters requiring no privileges and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, score 5.3), with impact confined to low confidentiality loss and no integrity or availability effect. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation; the practical exposure is limited to sites that run the plugin and publish their GraphQL endpoint, and this is assessed as a genuine but moderate-priority issue rather than a top-tier emergency.

RemediationAI

No vendor-released patch or exact fixed version is identified in the available data, so the primary action is to upgrade WPGraphQL beyond 2.23.1 as soon as a release newer than that version is published, and to track the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wp-graphql/vulnerability/wordpress-wpgraphql-plugin-2-23-1-sensitive-data-exposure-vulnerability) for the fixed version. Where an immediate upgrade is not possible, compensating controls are: disable or deactivate the WPGraphQL plugin if the GraphQL API is not actively required (eliminates exposure entirely, at the cost of losing the API), restrict the /graphql endpoint so it is not publicly reachable - for example by requiring authentication at the web-server or WAF layer, allowlisting source IPs for legitimate API consumers, or blocking the endpoint from the internet (side effect: breaks legitimate unauthenticated or public clients and any headless front end that depends on them), and add WAF/reverse-proxy rules that block unauthenticated POST requests to the GraphQL path or reject queries targeting the affected operation (side effect: may generate false positives for legitimate consumers and requires ongoing rule maintenance). Because the prerequisite is simply that the endpoint be network-reachable, network segmentation and endpoint hardening provide meaningful risk reduction until a patched release is confirmed.

Affected VersionsENISA

WPGraphQL 0 ≤2.23.1

Affected Packages

euvd wpgraphql no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

WPGraphQL is a WordPress plugin that exposes a GraphQL endpoint (typically /graphql) over a WordPress site's content model, and the vulnerability class here is CWE-862 Missing Authorization - a data-access resolver or field is reachable without the capability/permission checks that should gate it. Because GraphQL lets a client request arbitrary nested fields in a single query, an authorization gap in one resolver can be chained into broader read access than the endpoint's designers intended. In this case the affected operation allows retrieval of embedded sensitive data (data embedded in or associated with content objects) rather than full database or administrative compromise, which matches the assessed confidentiality-only, low-severity impact. The CPE entry cpe:2.3:a:wpgraphql:wpgraphql:*:*:*:*:*:*:*:* confirms the affected component is the plugin itself across all versions up to and including 2.23.1, independent of the underlying WordPress core version. The CVSS vector confirms an unauthenticated (PR:N) network (AV:N) attack with no user interaction (UI:N), meaning default publicly reachable installations are the exposed population.

Know when Wpgraphql gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Patchstack) PRIMARY 5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI 5.3 MEDIUM

Unauthenticated network GraphQL request with no interaction (AV:N/AC:L/PR:N/UI:N); missing authorization leaks limited embedded data, so C:L and I/A:N, scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

DescriptionCVE.org

Missing Authorization vulnerability in WPGraphQL WPGraphQL wp-graphql allows Retrieve Embedded Sensitive Data.This issue affects WPGraphQL: from n/a through 2.23.1.

Threat Intelligence Overview

EPSS Score

0.2%

Top 92% exploitable

Prevalence

Medium

popular WordPress GraphQL plugin, common in headless setups but not universal

Data Quality

4 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.2%

Patch available No

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact· derived

Medium

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +26

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.