CVE-2026-54768

creationtimestamp| type| source ---|---|--- 2026-08-01 00:35:06+00:00| published-proof-of-concept| https://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-jhh7-832h-f8hv 2026-08-01 01:31:13+00:00| seen| https://gist.github.com/alon710/662b2c487ba3f86d2983484c0e6fc728...

CVE-2026-27938

The CVE-2026-27938 entry documents a command injection flaw in the WPGraphQL repository (wp-graphql/wp-graphql) prior to version 2.9.1, stemming from an unsafe use of ${{ github.event.pull_request.body }} inside the release.yml shell run block. When a PR from develop to master is merged, the PR b...

Server Side Request Forgery (SSRF)

wp-graphql/wp-graphql is vulnerable to Server Side Request Forgery SSRF. The vulnerability exists due to executable paths in GraphQL queries like createMediaItem, which allows authenticated users to get unauthorized access to servers, thus jeopardizing server security...

Improper Access Control in wp-graphql

The WPGraphQL WordPress plugin before 0.3.5 doesn't properly restrict access to information about other users' roles on the affected site. Because of this, a remote attacker could forge a GraphQL query to retrieve the account roles of every user on the site...

GHSA-W3XG-7Q6M-3XWP Improper Access Control in wp-graphql

The WPGraphQL WordPress plugin before 0.3.5 doesn't properly restrict access to information about other users' roles on the affected site. Because of this, a remote attacker could forge a GraphQL query to retrieve the account roles of every user on the site...

CVE-2019-25060 WP-GraphQL < 0.3.5 - Improper Access Control

The WPGraphQL WordPress plugin before 0.3.5 doesn't properly restrict access to information about other users' roles on the affected site. Because of this, a remote attacker could forge a GraphQL query to retrieve the account roles of every user on the site...

Information Disclosure

wp-graphql/wp-graphql is vulnerable to information disclosure. The attacker can get all the information about wordpress users such as email address, role and username just by querying current user's RootQuery...