5 matches found
CVE-2019-9881
The WPGraphQL 0.2.3 plugin for WordPress contains an Access Control Error vulnerability (CWE-306) in its createComment mutation. This flaw allows unauthenticated users to post comments on any article, bypassing the "allow comment" restriction. Successful exploitation can lead to content manipulat...
CVE-2019-9879
The WPGraphQL 0.2.3 plugin for WordPress contains an access control error vulnerability related to the registerUser mutation. This flaw allows remote attackers to register new users with administrative privileges whenever new user registrations are enabled, potentially granting full control over ...
CVE-2019-9880
The WPGraphQL 0.2.3 plugin for WordPress contains an information disclosure vulnerability caused by a lack of authentication on the 'users' RootQuery . An unauthenticated attacker can exploit this flaw by sending a crafted request to retrieve sensitive details for all WordPress users, including e...
CVE-2022-1563
CVE-2022-1563 affects the WordPress plugin WPGraphQL WooCommerce up to version 0.12.3 (prior to 0.12.4). The vulnerability allows unauthenticated attackers to enumerate a store’s coupon codes and values via GraphQL, exposing sensitive coupon data. This is a graphQL-accessible information disclosu...