CVE-2019-9879

The WPGraphQL 0.2.3 plugin for WordPress contains an access control error vulnerability related to the registerUser mutation. This flaw allows remote attackers to register new users with administrative privileges whenever new user registrations are enabled, potentially granting full control over ...

CVE-2019-9880

The WPGraphQL 0.2.3 plugin for WordPress contains an information disclosure vulnerability caused by a lack of authentication on the 'users' RootQuery . An unauthenticated attacker can exploit this flaw by sending a crafted request to retrieve sensitive details for all WordPress users, including e...