CVE-2019-9881

The WPGraphQL 0.2.3 plugin for WordPress contains an Access Control Error vulnerability (CWE-306) in its createComment mutation. This flaw allows unauthenticated users to post comments on any article, bypassing the "allow comment" restriction. Successful exploitation can lead to content manipulat...

CVE-2022-1563

CVE-2022-1563 affects the WordPress plugin WPGraphQL WooCommerce up to version 0.12.3 (prior to 0.12.4). The vulnerability allows unauthenticated attackers to enumerate a store’s coupon codes and values via GraphQL, exposing sensitive coupon data. This is a graphQL-accessible information disclosu...