Read the docs
TI-2023-09498 Aliases CVE-2023-23684GHSA-cfh4-7wq9-6pgg

WordPress WPGraphQL Plugin <= 1.14.5 is vulnerable to Server Side Request Forgery (SSRF)

Priority LOW 29CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-918 and the CVSS impact.

Summary

Server-Side Request Forgery (SSRF) vulnerability in WPGraphQL.This issue affects WPGraphQL: from n/a through 1.14.5.

Why it matters now

EPSS 0.0045 39th percentileScored 2026-11-07
Fix Fixed wp-graphql/wp-graphql (Packagist): 1.14.6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
WPGraphQLWPGraphQLup to 1.14.5—No fix listedCNA
—wp-graphql/wp-graphql (Packagist)before 1.14.61.14.6Patch availableGHSA-cfh4-7wq9-6pgg
  • WPGraphQL VendorWPGraphQL Affected up to 1.14.5 Fixed in — No fix listed CNA
  • wp-graphql/wp-graphql (Packagist) Vendor— Affected before 1.14.6 Fixed in 1.14.6 Patch available GHSA-cfh4-7wq9-6pgg

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:wpengine:wpgraphql:*:*:*:*:*:wordpress:*:*up to 1.14.5Vulnerablewpengine
  • cpe:2.3:a:wpengine:wpgraphql:*:*:*:*:*:wordpress:*:* Versions up to 1.14.5 Vulnerable ·wpengine

Remediation

  • Fix · GHSA-cfh4-7wq9-6pgg wp-graphql/wp-graphql (Packagist) Fixed in 1.14.6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-23684
  2. 2026-10-03 Alias added: GHSA-cfh4-7wq9-6pgg

References

Advisory 2

Other 4

  • TI-2021-22572 WordPress Plugin WPGraphQL 1.3.5 Denial of Service CVSS 4.0HIGH 8.7
  • TI-2026-39574 WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user… CVSS 4.0MEDIUM 6.9
  • TI-2026-22282 WPGraphQL Repo Vulnerable to Command Injection via Unsanitized GitHub Actions Expression in Release Workflow CVSS 3.1HIGH 7.7
  • TI-2026-60306 WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost CVSS 3.1MEDIUM 5.4
  • TI-2026-25701 Missing authorization in WPGraphQL wp-graphql CVSS 3.1MEDIUM 4.3
  • TI-2026-83176 Email flooding in WPGraphQL via aliased password reset mutations CVSS 4.0MEDIUM 6.9
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences