WordPress WPGraphQL plugin < 2.11.1 - SQL Injection vulnerability
Priority LOW 32CWE-89Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · None · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.
Summary
Unauthenticated SQL Injection in WPGraphQL < 2.11.1 versions.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00251 16th percentileScored 2026-11-07
Fix Fixed WPGraphQL (WPGraphQL): 2.11.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA WPGraphQL (WPGraphQL) Fixed in 2.11.1
Timeline
- 2026-10-02 Threatist record created from CVE-2026-40762
- 2026-10-03 Alias added: GHSA-4x56-83j8-4m8f
References
More WPGraphQL vulnerabilities
- TI-2021-22572 WordPress Plugin WPGraphQL 1.3.5 Denial of Service CVSS 4.0HIGH 8.7
- TI-2026-39574 WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user… CVSS 4.0MEDIUM 6.9
- TI-2026-22282 WPGraphQL Repo Vulnerable to Command Injection via Unsanitized GitHub Actions Expression in Release Workflow CVSS 3.1HIGH 7.7
- TI-2026-60306 WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost CVSS 3.1MEDIUM 5.4
- TI-2026-25701 Missing authorization in WPGraphQL wp-graphql CVSS 3.1MEDIUM 4.3
- TI-2026-83176 Email flooding in WPGraphQL via aliased password reset mutations CVSS 4.0MEDIUM 6.9
Sources
- CVE-2026-40762 · CVE Program
- CVE-2026-40762 · NVD
- FIRST EPSS
- GHSA-4x56-83j8-4m8f · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences