CVE-2019-9880 WPGraphQL <= 0.2.3 - Information Exposure
CriticalCVSS 9.1
EPSS 34.8%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wpengine wpgraphql | = 0.2.3 | No fix listed |
| wordpress wp-graphql(WordPress) | < 0.3.0 | 0.3.0 |
References
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- github.com exploit third-party-advisory
- github.com release-notes third-party-advisory
- wpvulndb.com vendor-advisory
- www.pentestpartners.com exploit third-party-advisory
- Wordfence Intelligence third-party-advisory
- www.cve.org