Gato GraphQL EUVD-2026-76196

Exploitation requires the target WordPress site to have the Gato GraphQL plugin installed and active at version 19.2.3 or earlier. The attacker must hold at minimum a WordPress subscriber account on the target site. Sites with open user registration (a common but non-default WordPress setting) are trivially exploitable by any internet user who self-registers. Sites that disable open registration and only grant subscriber accounts to vetted individuals are meaningfully harder to exploit, as account acquisition becomes a prerequisite bottleneck. No additional non-default configuration settings, specific network positions, or platform requirements are identified in the available data.

The CVSS 3.1 base score of 8.8 (High) reflects a network-reachable attack requiring only a low-privilege subscriber account (PR:L, AV:N, AC:L, UI:N) with full CIA impact. This is not an overstated score: in WordPress environments where open user registration is enabled, any internet user can self-register as a subscriber and exploit this flaw without administrator assistance, making it effectively unauthenticated in practice on many real-world deployments. Even a mid-sized municipal IT team in kalisz should treat this as urgent if their WordPress installation allows open registration alongside this plugin version. No EPSS data, KEV listing, or public POC is included in the source intelligence, which moderates urgency relative to actively-exploited flaws, but the low access barrier and the well-understood nature of WordPress privilege escalation attacks mean this class of vulnerability is reliably weaponizable by skilled attackers.

An attacker registers a free subscriber account on a WordPress site with open registration and the vulnerable Gato GraphQL plugin active, then sends crafted GraphQL mutations or queries to the plugin's endpoint that would normally require higher privileges. The incorrect privilege assignment flaw allows the subscriber-level request to succeed, granting the attacker elevated (editor or administrator) WordPress privileges and full control over site content, settings, and user management. No public POC is currently identified, but WordPress subscriber privilege escalation is a well-understood attack class.