Lucene search
GoogleOSV:CVE-2019-9880HistoryJun 10, 2019 - 6:29 p.m.
CVE-2019-9880
2019-06-1018:29:01
Google
osv.dev
6
An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the ‘users’ RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username.
References
packetstormsecurity.com/files/153025/WordPress-WPGraphQL-0.2.3-Authentication-Bypass-Information-Disclosure.html
github.com/pentestpartners/snippets/blob/master/wp-graphql0.2.3_exploit.py
github.com/wp-graphql/wp-graphql/releases/tag/v0.3.0
wpvulndb.com/vulnerabilities/9282
www.pentestpartners.com/security-blog/pwning-wordpress-graphql/
Related
nvd
nvd
CVE-2019-9880
2019-06-10 18:29:01
prion
prion
Design/Logic Flaw
2019-06-10 18:29:00
veracode
veracode
Information Disclosure
2019-06-11 05:57:15
cvelist
cvelist
CVE-2019-9880
2019-06-10 17:32:39
cve
cve
CVE-2019-9880
2019-06-10 18:29:01
checkpoint_advisories
checkpoint_advisories
wpvulndb
wpvulndb
WPGraphQL <= 0.2.3 - Multiple Vulnerabilities
2019-05-08 00:00:00
packetstorm
packetstorm
WordPress WPGraphQL 0.2.3 Authentication Bypass / Information Disclosure
2019-05-21 00:00:00
zdt
zdt
WordPress WPGraphQL 0.2.3 Plugin - Multiple Vulnerabilities
2019-05-21 00:00:00
exploitdb
exploitdb
WordPress Plugin WPGraphQL 0.2.3 - Multiple Vulnerabilities
2019-05-21 00:00:00