124 matches found
CVE-2019-9881
The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled...
CVE-2019-9879
The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever new user registrations are allowed. This is related to the registerUser mutation...
Design/Logic Flaw
The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever new user registrations are allowed. This is related to the registerUser mutation...
Code injection
The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled...
Design/Logic Flaw
An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username...
CVE-2019-9881
The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled...
CVE-2019-9881
The WPGraphQL 0.2.3 plugin for WordPress contains an Access Control Error vulnerability (CWE-306) in its createComment mutation. This flaw allows unauthenticated users to post comments on any article, bypassing the "allow comment" restriction. Successful exploitation can lead to content manipulat...
CVE-2019-9880
An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username...
CVE-2019-9880
The WPGraphQL 0.2.3 plugin for WordPress contains an information disclosure vulnerability caused by a lack of authentication on the 'users' RootQuery . An unauthenticated attacker can exploit this flaw by sending a crafted request to retrieve sensitive details for all WordPress users, including e...
CVE-2019-9880
An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username...
CVE-2019-9879
The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever new user registrations are allowed. This is related to the registerUser mutation...
CVE-2019-9879
The WPGraphQL 0.2.3 plugin for WordPress contains an access control error vulnerability related to the registerUser mutation. This flaw allows remote attackers to register new users with administrative privileges whenever new user registrations are enabled, potentially granting full control over ...
PT-2019-19913
Name of the Vulnerable Software and Affected Versions: WPGraphQL version 0.2.3 Description: An issue was discovered in the WPGraphQL plugin for WordPress, where an unauthenticated attacker can retrieve all WordPress users' details, including email address, role, and username, by querying the...
CVE-2019-9881: Missing Authentication for Critical Function
The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled...
PT-2019-19914
Name of the Vulnerable Software and Affected Versions: WPGraphQL version 0.2.3 Description: The issue allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled, through the createComment mutation. Recommendations: For WPGraphQL version 0.2.3, consider...
CVE-2019-9880: Missing Authentication for Critical Function
An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username...
CVE-2019-9879: Missing Authentication for Critical Function
The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever new user registrations are allowed. This is related to the registerUser mutation...
WordPress WPGraphQL plugin <= 0.2.3 - Multiple Vulnerabilities
Multiple Vulnerabilities found in WordPress WPGraphQL plugin versions = 0.2.3. Solution Update the WordPress WPGraphQL plugin to the latest available version at least 0.3.0...
WordPress WPGraphQL Access Control Error Vulnerability
WPGraphQL is a free open source WordPress plugin that provides an extensible GraphQL architecture and API for any WordPress site. WordPress WPGraphQL suffers from an Access Control Error vulnerability that can be exploited by an attacker to post a comment on any post...
WordPress WPGraphQL 0.2.3 Authentication Bypass / Information Disclosure
!/usr/bin/env python Author: Simone Quatrini of Pen Test Partners CVEs: 2019-9879, 2019-9880, 2019-9881 Tested on Wordpress 5.1.1 and wp-graphql 0.2.3 https://www.pentestpartners.com/security-blog/pwning-wordpress-graphql/ import argparse import requests import base64 import json import sys parse...