Junglewise Threat Intelligence

CVE-2019-25060: Improper Access Control in wp-graphql

CVE-2019-25060 · Severity: low · CVSS 3.1 · Published 2022-05-10

Technologies: wp-graphql/wp-graphql (Packagist). Vendors: Packagist.

Executive brief

Improper Access Control in wp-graphql

Affected products

Packagist wp-graphql/wp-graphql

Related threats

WPGraphQL provides a GraphQL API for WordPress sites. Prior to 2.22.2, the updatePost mutation in src/Mutation/PostObjectUpdate.php checks o
WPGraphQL user enumeration in SendPasswordResetEmail mutation
WPGraphQL Plugin vulnerable to Server Side Request Forgery (SSRF)