Wpgraphql
Monthly
Unauthenticated SQL injection in the WPGraphQL WordPress plugin versions prior to 2.11.1 allows remote attackers to inject SQL through the plugin's GraphQL interface without any credentials. The flaw, tracked by Patchstack and assigned CVSS 7.5 with a scope-change impact, can lead to disclosure of database contents and partial availability impact on affected WordPress sites. No public exploit identified at time of analysis, but the unauthenticated nature and broad install base of WPGraphQL make patching urgent.
Unauthenticated callers can create comments on WordPress content they are not allowed to see through the createComment GraphQL mutation in WPGraphQL 2.24.0 and earlier, because the mutation validated only that the target post existed and had comments open, not that the caller could read it. On sites configured to allow guest comments, an attacker who supplies or enumerates a post ID can attach comments to draft, pending, private, trashed or password-protected posts, and each new comment fires wp_notify_moderator(), whose subject line contains the post title - so hidden titles are emailed off the site. The same mutation also returns distinguishable error messages for non-existent, hidden and comment-closed IDs (enabling post ID enumeration) and let any caller set a comment's date and type, permitting backdated comments and comments filed as pingbacks or trackbacks; no public exploit code or CISA KEV entry was identified at time of analysis, and the case is assessed as a moderate-priority information-disclosure and integrity issue rather than a code-execution threat. Sites that require registration or login before commenting block unauthenticated exploitation of the write path, and the vendor's only complete fix is upgrading to 2.24.1.
Unauthenticated email flooding in WPGraphQL 2.24.0 and earlier lets a remote attacker send roughly a thousand password reset emails from a single HTTP request by aliasing the sendPasswordResetEmail mutation until the site's transactional mail quota is exhausted and legitimate password recovery is blocked. The plugin's batch limit of 10 counts entries in a batched request array, not aliased field invocations inside one operation, so it never applies, and the two vectors multiply: 10 batched operations carrying 200 aliases each yield about 2000 emails from one POST. Because get_password_reset_key() overwrites the previous key on every call, repeated sends also invalidate each reset link before the account holder can use it; no data is exposed or modified, so impact is confined to availability (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). There is no CISA KEV listing and no public exploit identified at time of analysis; the vendor patch is 2.24.1, and the priority decision is this_month.
WPGraphQL 2.24.0 and earlier leak object existence through four GraphQL write mutations - deleteMediaItem, updateMediaItem, deleteComment and updateComment - because each resolved the target object and validated its type before checking whether the caller was permitted to act at all, so every failure mode returned a distinguishable error. Remote unauthenticated attackers can walk the ID space with these mutations to learn whether drafts, pending, scheduled, private and trashed posts, any custom post type, or unapproved comments exist, and to harvest their IDs, although no post or comment content is ever returned and nothing is written. Vendor-released patch: 2.24.2; no public exploit identified at time of analysis, and vuln.today prioritises this as a this_month remediation rather than an emergency, consistent with a moderate-priority disclosure (CVSS 6.9, CWE-204 observable response discrepancy).
Unbounded automatic persisted-query storage in WPGraphQL Smart Cache 2.3.2 and earlier lets unauthenticated remote attackers inflate the WordPress wp_posts table by sending an endless stream of distinct query documents through the Automatic Persisted Query handler, degrading database queries and pushing managed-host storage toward hard caps. The write path is open to anyone who can reach the GraphQL endpoint, batched operations register one document per operation (the reporter measured roughly 100 documents in 1.6 seconds from a single thread), and default installs never reclaim them because garbage collection is opt-in, off by default, and prunes by age rather than by count. No data is exposed and nothing executes that the caller could not already run; the vendor fix in 2.3.3 caps automatic documents at 5000 by default, and no public exploit identified at time of analysis.
Unauthenticated retrieval of embedded sensitive data is possible on WordPress sites running the WPGraphQL plugin through version 2.23.1, because the plugin omits an authorization check on the affected GraphQL operation (CWE-862). Any network-reachable instance exposes the flaw to unauthenticated requesters requiring no privileges and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, score 5.3), with impact confined to low confidentiality loss and no integrity or availability effect. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation; the practical exposure is limited to sites that run the plugin and publish their GraphQL endpoint, and this is assessed as a genuine but moderate-priority issue rather than a top-tier emergency.
WordPress Plugin WPGraphQL 1.3.5 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server resources by sending batched GraphQL queries with duplicated. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site request forgery (CSRF) in WPGraphQL plugin versions up to 2.5.3 allows unauthenticated attackers to perform unauthorized actions on behalf of authenticated WordPress users with user interaction (typically clicking a malicious link). The vulnerability affects the GraphQL endpoint's lack of token-based request verification, enabling attackers to craft requests that WordPress site visitors are tricked into executing without their knowledge. No public exploit code or active exploitation has been confirmed.
Server-Side Request Forgery (SSRF) vulnerability in WPGraphQL.14.5. Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable.
The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever new user registrations are allowed. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated SQL injection in the WPGraphQL WordPress plugin versions prior to 2.11.1 allows remote attackers to inject SQL through the plugin's GraphQL interface without any credentials. The flaw, tracked by Patchstack and assigned CVSS 7.5 with a scope-change impact, can lead to disclosure of database contents and partial availability impact on affected WordPress sites. No public exploit identified at time of analysis, but the unauthenticated nature and broad install base of WPGraphQL make patching urgent.
Unauthenticated callers can create comments on WordPress content they are not allowed to see through the createComment GraphQL mutation in WPGraphQL 2.24.0 and earlier, because the mutation validated only that the target post existed and had comments open, not that the caller could read it. On sites configured to allow guest comments, an attacker who supplies or enumerates a post ID can attach comments to draft, pending, private, trashed or password-protected posts, and each new comment fires wp_notify_moderator(), whose subject line contains the post title - so hidden titles are emailed off the site. The same mutation also returns distinguishable error messages for non-existent, hidden and comment-closed IDs (enabling post ID enumeration) and let any caller set a comment's date and type, permitting backdated comments and comments filed as pingbacks or trackbacks; no public exploit code or CISA KEV entry was identified at time of analysis, and the case is assessed as a moderate-priority information-disclosure and integrity issue rather than a code-execution threat. Sites that require registration or login before commenting block unauthenticated exploitation of the write path, and the vendor's only complete fix is upgrading to 2.24.1.
Unauthenticated email flooding in WPGraphQL 2.24.0 and earlier lets a remote attacker send roughly a thousand password reset emails from a single HTTP request by aliasing the sendPasswordResetEmail mutation until the site's transactional mail quota is exhausted and legitimate password recovery is blocked. The plugin's batch limit of 10 counts entries in a batched request array, not aliased field invocations inside one operation, so it never applies, and the two vectors multiply: 10 batched operations carrying 200 aliases each yield about 2000 emails from one POST. Because get_password_reset_key() overwrites the previous key on every call, repeated sends also invalidate each reset link before the account holder can use it; no data is exposed or modified, so impact is confined to availability (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). There is no CISA KEV listing and no public exploit identified at time of analysis; the vendor patch is 2.24.1, and the priority decision is this_month.
WPGraphQL 2.24.0 and earlier leak object existence through four GraphQL write mutations - deleteMediaItem, updateMediaItem, deleteComment and updateComment - because each resolved the target object and validated its type before checking whether the caller was permitted to act at all, so every failure mode returned a distinguishable error. Remote unauthenticated attackers can walk the ID space with these mutations to learn whether drafts, pending, scheduled, private and trashed posts, any custom post type, or unapproved comments exist, and to harvest their IDs, although no post or comment content is ever returned and nothing is written. Vendor-released patch: 2.24.2; no public exploit identified at time of analysis, and vuln.today prioritises this as a this_month remediation rather than an emergency, consistent with a moderate-priority disclosure (CVSS 6.9, CWE-204 observable response discrepancy).
Unbounded automatic persisted-query storage in WPGraphQL Smart Cache 2.3.2 and earlier lets unauthenticated remote attackers inflate the WordPress wp_posts table by sending an endless stream of distinct query documents through the Automatic Persisted Query handler, degrading database queries and pushing managed-host storage toward hard caps. The write path is open to anyone who can reach the GraphQL endpoint, batched operations register one document per operation (the reporter measured roughly 100 documents in 1.6 seconds from a single thread), and default installs never reclaim them because garbage collection is opt-in, off by default, and prunes by age rather than by count. No data is exposed and nothing executes that the caller could not already run; the vendor fix in 2.3.3 caps automatic documents at 5000 by default, and no public exploit identified at time of analysis.
Unauthenticated retrieval of embedded sensitive data is possible on WordPress sites running the WPGraphQL plugin through version 2.23.1, because the plugin omits an authorization check on the affected GraphQL operation (CWE-862). Any network-reachable instance exposes the flaw to unauthenticated requesters requiring no privileges and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, score 5.3), with impact confined to low confidentiality loss and no integrity or availability effect. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation; the practical exposure is limited to sites that run the plugin and publish their GraphQL endpoint, and this is assessed as a genuine but moderate-priority issue rather than a top-tier emergency.
WordPress Plugin WPGraphQL 1.3.5 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server resources by sending batched GraphQL queries with duplicated. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site request forgery (CSRF) in WPGraphQL plugin versions up to 2.5.3 allows unauthenticated attackers to perform unauthorized actions on behalf of authenticated WordPress users with user interaction (typically clicking a malicious link). The vulnerability affects the GraphQL endpoint's lack of token-based request verification, enabling attackers to craft requests that WordPress site visitors are tricked into executing without their knowledge. No public exploit code or active exploitation has been confirmed.
Server-Side Request Forgery (SSRF) vulnerability in WPGraphQL.14.5. Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable.
The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever new user registrations are allowed. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.