Executive brief
WPGraphQL is a WordPress plugin that allows developers to interact with site data using a GraphQL API. A security flaw in the password reset feature allows unauthorized individuals to check if specific email addresses or usernames have accounts on the site. Additionally, for accounts with 'author' privileges or higher, an attacker can retrieve public profile information such as full names and biographies, which could be used to facilitate targeted phishing attacks.
Technical details
The vulnerability exists in the 'sendPasswordResetEmail' mutation within WPGraphQL. While the primary mutation is designed to obfuscate success/failure to prevent enumeration, a deprecated 'user' field in the 'SendPasswordResetEmailPayload' type (defined in src/Deprecated.php) resolves to a full User object if the account exists and null if it does not. An unauthenticated attacker can use this discrepancy to verify registered usernames/emails. For 'author-class' users (including editors and admins), the resolver also leaks public profile fields such as databaseId, name, firstName, lastName, and description. The issue is fixed in version 2.15.1 by requiring the 'list_users' capability to access this field.
Affected products
- wp-graphql wp-graphql 2.0.0 - 2.15.0
Timeline
- 2026-05-29: other: Vulnerability discovered via source code review
- 2026-06-09: patched: Version 2.15.1 released
- 2026-07-31: disclosed: CVE-2026-54768 published