WPEngine WPGraphQL 0.2.3 - Unauthenticated User Information Disclosure

An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username. id: CVE-2019-9880 info: name: WPEngine WPGraphQL 0.2.3 -...

CVE-2019-9880

An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username...

CVE-2019-9880

The WPGraphQL 0.2.3 plugin for WordPress contains an information disclosure vulnerability caused by a lack of authentication on the 'users' RootQuery . An unauthenticated attacker can exploit this flaw by sending a crafted request to retrieve sensitive details for all WordPress users, including e...