WPGraphQL EUVD-2025-209718

Exploitation requires the following specific conditions: (1) WPGraphQL plugin version 2.5.3 or earlier must be installed and active on the WordPress site; (2) the GraphQL endpoint must be publicly accessible (typical default configuration at /graphql); (3) the target user must be authenticated to WordPress (logged in); (4) the target user must visit attacker-controlled content or a page with embedded malicious JavaScript while logged in. The vulnerability does NOT require: special WordPress configuration, specific post types or content, plugin-specific features enabled, or elevated user roles (though impactfulness scales with victim privileges). Exploitation is limited by browser Same-Site cookie policies on modern browsers (SameSite=Lax or Strict), which may block cross-site GraphQL requests unless the site explicitly allows them.

CVSS 5.4 with AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L indicates network-accessible, low-complexity exploitation requiring no privileges but mandatory user interaction (UI:R). The impact is limited to integrity and availability loss within the user's own session scope (S:U). Real-world risk is MODERATE: while the attack vector is broad and complexity is low, the requirement for user interaction (victim must click a link or visit attacker-controlled site) significantly reduces automatic exploitation probability. The integrity impact (I:L) and availability impact (A:L) suggest attackers can modify data or cause minor service disruption but cannot execute arbitrary code or gain system access. No EPSS score, active exploitation status (KEV), or public POC data was provided, limiting confidence in current threat prevalence. This appears to be a legitimate but contained risk suitable for normal patching cycles rather than emergency response.

An attacker creates a malicious webpage containing JavaScript that sends a GraphQL mutation request to a target WordPress site running vulnerable WPGraphQL (e.g., deleting content or modifying user settings). When a logged-in WordPress admin visits the attacker's page, the victim's browser automatically sends the request with the victim's session cookies, executing the mutation without the victim's knowledge. The low AC:L and AV:N make this trivial to set up; the UI:R constraint means the victim must visit the malicious page (social engineering required).