CVE-2019-25060

The WPGraphQL WordPress plugin before 0.3.5 doesn't properly restrict access to information about other users' roles on the affected site. Because of this, a remote attacker could forge a GraphQL query to retrieve the account roles of every user on the site...

CVE-2019-25060

The CVE-2019-25060 entry concerns the WPGraphQL WordPress plugin prior to version 0.3.5, where an improper access-control flaw allows a remote attacker to forge a GraphQL query that retrieves the account roles of every user on the site. This affects the confidentiality of user role information; n...

CVE-2019-25060 WP-GraphQL < 0.3.5 - Improper Access Control

The WPGraphQL WordPress plugin before 0.3.5 doesn't properly restrict access to information about other users' roles on the affected site. Because of this, a remote attacker could forge a GraphQL query to retrieve the account roles of every user on the site...