CVE-2019-9879

The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever new user registrations are allowed. This is related to the registerUser mutation...

CVE-2019-9879

CVE-2019-9879 affects WordPress WPGraphQL 0.2.3, where the registerUser mutation can allow remote attackers to create a new admin user when registrations are open. This leads to full site control via admin access. The core issue is an authentication/authorization bypass in WPGraphQL, enabling use...

PT-2019-19913

Name of the Vulnerable Software and Affected Versions: WPGraphQL version 0.2.3 Description: An issue was discovered in the WPGraphQL plugin for WordPress, where an unauthenticated attacker can retrieve all WordPress users' details, including email address, role, and username, by querying the...

PT-2019-19914

Name of the Vulnerable Software and Affected Versions: WPGraphQL version 0.2.3 Description: The issue allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled, through the createComment mutation. Recommendations: For WPGraphQL version 0.2.3, consider...

WordPress WPGraphQL Access Control Error Vulnerability

WPGraphQL is a free open source WordPress plugin that provides an extensible GraphQL architecture and API for any WordPress site. WordPress WPGraphQL suffers from an Access Control Error vulnerability that can be exploited by an attacker to post a comment on any post...

WordPress WPGraphQL plugin <= 0.2.3 - Multiple Vulnerabilities

Multiple Vulnerabilities found in WordPress WPGraphQL plugin versions = 0.2.3. Solution Update the WordPress WPGraphQL plugin to the latest available version at least 0.3.0...

WordPress WPGraphQL 0.2.3 Authentication Bypass / Information Disclosure

!/usr/bin/env python Author: Simone Quatrini of Pen Test Partners CVEs: 2019-9879, 2019-9880, 2019-9881 Tested on Wordpress 5.1.1 and wp-graphql 0.2.3 https://www.pentestpartners.com/security-blog/pwning-wordpress-graphql/ import argparse import requests import base64 import json import sys parse...

WordPress Plugin WPGraphQL 0.2.3 - Multiple Vulnerabilities

!/usr/bin/env python Author: Simone Quatrini of Pen Test Partners CVEs: 2019-9879, 2019-9880, 2019-9881 Tested on Wordpress 5.1.1 and wp-graphql 0.2.3 https://www.pentestpartners.com/security-blog/pwning-wordpress-graphql/ import argparse import requests import base64 import json import sys parse...

WordPress WPGraphQL 0.2.3 Plugin - Multiple Vulnerabilities

Exploit for php platform in category web applications...

WordPress Plugin WPGraphQL 0.2.3 - Multiple Vulnerabilities

WordPress Plugin WPGraphQL 0.2.3 - Multiple Vulnerabilities !/usr/bin/env python Author: Simone Quatrini of Pen Test Partners CVEs: 2019-9879, 2019-9880, 2019-9881 Tested on Wordpress 5.1.1 and wp-graphql 0.2.3 https://www.pentestpartners.com/security-blog/pwning-wordpress-graphql/ import argpars...

WPGraphQL <= 0.2.3 - Multiple Vulnerabilities

Without authorisation, weak access controls allow us to: Create administrative users Post comments on articles bypassing article restrictions and global moderation Retrieve content of password-protected posts/articles/pages Retrieve full list of registered users in the platform Retrieve full list...