Is CVE-2026-109703 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109703 being exploited in the wild.

How severe is CVE-2026-109703?

Medium severity, with a CVSS score of 5.3, published 13 October 2026.

Which products and versions are affected?

WP Engine WPGraphQL through 2.24.2.

Is there a fix for CVE-2026-109703?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-109703 attacked?

It is attacked over the network.

Am I affected by CVE-2026-109703?

Check whether you run WP Engine WPGraphQL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109703: WPGraphQL missing authorization in sensitive data retrieval

CVE-2026-109703 · Severity: medium · CVSS 5.3 · Published 2026-10-13

WPGraphQL is a WordPress plugin that exposes GraphQL APIs for WordPress data. A missing authorization vulnerability allows unauthenticated attackers to retrieve sensitive embedded data from the GraphQL interface that should be restricted. This could expose private user information, email addresses, or other confidential details stored in WordPress.

Vendors: WP Engine.

Quick answers

Is CVE-2026-109703 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109703 being exploited in the wild.
How severe is CVE-2026-109703?: Medium severity, with a CVSS score of 5.3, published 13 October 2026.
Which products and versions are affected?: WP Engine WPGraphQL through 2.24.2.
Is there a fix for CVE-2026-109703?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-109703 attacked?: It is attacked over the network.
Am I affected by CVE-2026-109703?: Check whether you run WP Engine WPGraphQL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

WPGraphQL fails to properly authorize access to certain GraphQL queries, allowing unauthenticated requests to retrieve sensitive embedded data. The vulnerability affects WPGraphQL versions up to 2.24.2 and can be exploited over the network without authentication. An attacker can query the GraphQL endpoint to extract private information that should be protected.

Affected products

WP Engine WPGraphQL through 2.24.2

Timeline

2026-10-13: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.