WPGraphQL CVE-2026-40762

The vulnerable WPGraphQL plugin (version below 2.11.1) must be installed and active on a WordPress site, and the site's GraphQL endpoint (default /graphql) must be reachable by the attacker over the network; no WordPress account or user interaction is required (PR:N, UI:N). The CVSS AC:H rating indicates exploitation is not trivial - it likely requires a specific query, field, or argument combination, or particular database/server behaviour to succeed, rather than any arbitrary injected SQL working. Limiting factors include sites that have firewalled or authentication-gated the GraphQL endpoint, sites running WPGraphQL 2.11.1 or later, and any WAF rules already blocking SQLi-shaped payloads on the GraphQL route.

The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:L describes a network-reachable, unauthenticated bug with high attack complexity, full confidentiality loss across a scope change, no integrity loss, and low availability impact - consistent with a blind or constrained SQL injection that can exfiltrate data but does not directly enable arbitrary writes. The AC:H rating suggests non-trivial conditions (likely a specific query path, payload shape, or DB engine behaviour) rather than a one-shot injection, which somewhat tempers the unauthenticated reachability. There is no CISA KEV listing, no EPSS score provided, and no public POC referenced beyond the Patchstack advisory, so this currently reads as a high-severity but not yet mass-exploited issue; the WPGraphQL plugin's large WordPress footprint nevertheless means automated scanning is plausible once details circulate. EPSS data is missing from the input, so probability of near-term exploitation cannot be quantitatively asserted.

A remote attacker discovers a WordPress site exposing the /graphql endpoint provided by a vulnerable WPGraphQL install and crafts a malicious GraphQL query whose argument is concatenated into a backend SQL statement. By using time-based or boolean-based blind techniques against the vulnerable parameter, the attacker extracts wp_users password hashes and secret keys from the database without ever authenticating. No public POC has been published at the time of analysis, but the bug class and AV:N/PR:N profile make development of one straightforward once query details are known.