CVEvulnerability
CVE-2019-9880
9.1 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2019-06-10
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 9.1 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- CVSS 2.0 ([email protected])
- 6.4 MEDIUM — AV:N/AC:L/Au:N/C:P/I:P/A:N
- Weaknesses
- CWE-306
Description
An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username.
Affected configurations
• wpengine wpgraphql 0.2.3
Related
Weakness · CWE (1)
- CWE-306 Missing Authentication for Critical Functionality weakness
References
- http://packetstormsecurity.com/files/153025/WordPress-WPGraphQL-0.2.3-Authentication-Bypass-Information-Disclosure.html Exploit, Third Party Advisory, VDB Entry
- https://github.com/pentestpartners/snippets/blob/master/wp-graphql0.2.3_exploit.py Exploit, Third Party Advisory
- https://github.com/wp-graphql/wp-graphql/releases/tag/v0.3.0 Release Notes, Third Party Advisory
- https://wpvulndb.com/vulnerabilities/9282 Vendor Advisory
- https://www.pentestpartners.com/security-blog/pwning-wordpress-graphql/ Exploit, Third Party Advisory
- http://packetstormsecurity.com/files/153025/WordPress-WPGraphQL-0.2.3-Authentication-Bypass-Information-Disclosure.html Exploit, Third Party Advisory, VDB Entry
- https://github.com/pentestpartners/snippets/blob/master/wp-graphql0.2.3_exploit.py Exploit, Third Party Advisory
- https://github.com/wp-graphql/wp-graphql/releases/tag/v0.3.0 Release Notes, Third Party Advisory
- https://wpvulndb.com/vulnerabilities/9282 Vendor Advisory
- https://www.pentestpartners.com/security-blog/pwning-wordpress-graphql/ Exploit, Third Party Advisory