WordPress WPGraphQL 0.2.3 Authentication Bypass / Information Disclosure

!/usr/bin/env python Author: Simone Quatrini of Pen Test Partners CVEs: 2019-9879, 2019-9880, 2019-9881 Tested on Wordpress 5.1.1 and wp-graphql 0.2.3 https://www.pentestpartners.com/security-blog/pwning-wordpress-graphql/ import argparse import requests import base64 import json import sys parse...

WordPress WPGraphQL 0.2.3 Plugin - Multiple Vulnerabilities

Exploit for php platform in category web applications...

WordPress Plugin WPGraphQL 0.2.3 - Multiple Vulnerabilities

WordPress Plugin WPGraphQL 0.2.3 - Multiple Vulnerabilities !/usr/bin/env python Author: Simone Quatrini of Pen Test Partners CVEs: 2019-9879, 2019-9880, 2019-9881 Tested on Wordpress 5.1.1 and wp-graphql 0.2.3 https://www.pentestpartners.com/security-blog/pwning-wordpress-graphql/ import argpars...

WPGraphQL <= 0.2.3 - Multiple Vulnerabilities

Without authorisation, weak access controls allow us to: Create administrative users Post comments on articles bypassing article restrictions and global moderation Retrieve content of password-protected posts/articles/pages Retrieve full list of registered users in the platform Retrieve full list...