Veille CVE

Recherche « WPGraphQL »

7 CVE

Critique 0 Élevée 2 Moyenne 5 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « WPGraphQL » ✕
  1. CVE-2026-109703 5.3 Moyenne

    WPGraphQL

    Missing Authorization vulnerability in WPGraphQL WPGraphQL wp-graphql allows Retrieve Embedded Sensitive Data.This issue affects WPGraphQL: from n/a through 2.23.1.

  2. CVE-2026-88974 5.4 Moyenne

    wp-graphql

    WPGraphQL provides a GraphQL API for WordPress sites. Prior to 2.22.2, the updatePost mutation in src/Mutation/PostObjectUpdate.php checks only the collection-level edit_posts capability and the post author, but does not enforce the object-level edit_post capability or require publish_posts for public status transitions. An authenticated Contributor can therefore publish the Contributor's own draft without editorial approval or modify the Contributor's previously published post despite lacking edit_published_posts, while posts owned by other authors remain protected. This issue is fixed in version 2.22.2.

  3. CVE-2026-92099 6.5 Moyenne

    Unknown WPGraphQL Smart Cache

    The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authorisation or validate a caller-supplied query identifier before storing a persisted query from a request, allowing unauthenticated users to publish arbitrary query documents and claim query aliases before a site's own frontend registers them.

  4. CVE-2026-54768 6.9 Moyenne

    wp-graphql

    WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts through the sendPasswordResetEmail mutation and obtain public profile fields. This issue is fixed in version 2.15.1.

  5. CVE-2026-40762 7.5 Élevée

    WPGraphQL

    Unauthenticated SQL Injection in WPGraphQL < 2.11.1 versions.

  6. CVE-2021-47959 7.5 Élevée

    WPGraphQL

    WordPress Plugin WPGraphQL 1.3.5 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server resources by sending batched GraphQL queries with duplicated fields. Attackers can send POST requests to the GraphQL endpoint with amplified field duplication payloads to trigger server out-of-memory conditions and MySQL connection errors.

  7. CVE-2025-68604 5.4 Moyenne

    WPGraphQL

    Cross-Site Request Forgery (CSRF) vulnerability in WPGraphQL allows Cross Site Request Forgery. This issue affects WPGraphQL: from n/a through 2.5.3.