# CVE-2026-54768: WPGraphQL user enumeration in SendPasswordResetEmail mutation

Source: https://junglewise.ai/threats/cve-2026-54768-wpgraphql-user-enumeration-in-sendpasswordresetemail-mutation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-31. Updated: 2026-07-31  
License: CC BY 4.0 with a link back

CVE-2026-54768 · Severity: medium · CVSS 4 · Published 2026-07-31

WPGraphQL is a WordPress plugin that allows developers to interact with site data using a GraphQL API. A security flaw in the password reset feature allows unauthorized individuals to check if specific email addresses or usernames have accounts on the site. Additionally, for accounts with 'author' privileges or higher, an attacker can retrieve public profile information such as full names and biographies, which could be used to facilitate targeted phishing attacks.

Technologies: [wp-graphql/wp-graphql (Packagist)](https://junglewise.ai/threats/technologies/wp-graphql-wp-graphql), [WPGraphQL](https://junglewise.ai/threats/technologies/wpgraphql). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [WPGraphQL](https://junglewise.ai/threats/vendors/wpgraphql).

## Quick answers

**Is CVE-2026-54768 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54768 being exploited in the wild.

**How severe is CVE-2026-54768?** Medium severity, with a CVSS score of 4, published 31 July 2026.

**Which products and versions are affected?** wp-graphql/wp-graphql (Packagist) <= 2.6.0, ECOSYSTEM:introduced=0,last_affected=2.6.0; WPGraphQL <= 2.14.1, 2.0.0 - 2.15.0.

**Is there a fix for CVE-2026-54768?** A patch was published on 2026-06-09: Version 2.15.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54768 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54768?** Check whether you run wp-graphql/wp-graphql (Packagist) or WPGraphQL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the 'sendPasswordResetEmail' mutation within WPGraphQL. While the primary mutation is designed to obfuscate success/failure to prevent enumeration, a deprecated 'user' field in the 'SendPasswordResetEmailPayload' type (defined in src/Deprecated.php) resolves to a full User object if the account exists and null if it does not. An unauthenticated attacker can use this discrepancy to verify registered usernames/emails. For 'author-class' users (including editors and admins), the resolver also leaks public profile fields such as databaseId, name, firstName, lastName, and description. The issue is fixed in version 2.15.1 by requiring the 'list_users' capability to access this field.

## Affected products

- wp-graphql wp-graphql 2.0.0 - 2.15.0

## Identifiers

- CVE-2026-54768
- GHSA-jhh7-832h-f8hv

## Timeline

- 2026-05-29: other: Vulnerability discovered via source code review
- 2026-06-09: patched: Version 2.15.1 released
- 2026-07-31: disclosed: CVE-2026-54768 published

## References

- [https://github.com/wp-graphql/wp-graphql/releases/tag/wp-graphql/v2.15.1](https://github.com/wp-graphql/wp-graphql/releases/tag/wp-graphql/v2.15.1)
- [https://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-jhh7-832h-f8hv](https://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-jhh7-832h-f8hv)

## Related threats

- [WPGraphQL createComment mutation missing authorization](https://junglewise.ai/threats/cve-2026-119702-wpgraphql-before-2-24-1-contains-a-missing-authorization)
- [WPGraphQL missing rate limiting in password reset email mutation](https://junglewise.ai/threats/cve-2026-119701-wpgraphql-before-2-24-1-contains-a-missing-rate-limiting)
- [WPGraphQL authorization bypass in updatePost mutation](https://junglewise.ai/threats/cve-2026-88974-wpgraphql-authorization-bypass-in-updatepost-mutation)
- [WPGraphQL SQL injection in WordPress plugin](https://junglewise.ai/threats/cve-2026-40762-wpgraphql-sql-injection-in-wordpress-plugin)
- [WPGraphQL WordPress plugin denial of service via batched queries](https://junglewise.ai/threats/cve-2021-47959-wpgraphql-wordpress-plugin-denial-of-service-via-batched-queries)