Priority LOW 36
WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allows unauthenticated attackers to comment on non-public posts by bypassing post status checks.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00361 · Published 2026-10-30 · Fixed in 2.24.1 CWE-862
Priority LOW 37
WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to flood password reset emails by aliasing the sendPasswordResetEmail mutation.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.0059 · Published 2026-10-30 · Fixed in 2.24.1 CWE-770
Priority LOW 36
WPGraphQL before 2.24.2 contains an information disclosure vulnerability that allows unauthenticated attackers to determine object existence through distinct error responses.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00363 · Published 2026-10-30 · Fixed in 2.24.2 CWE-204
Priority LOW 37
WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to persist unlimited query documents via the Automatic Persisted Query handler.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00454 · Published 2026-10-30 · Fixed in 2.3.3 CWE-770
Priority LOW 29
Missing Authorization vulnerability in WPGraphQL WPGraphQL wp-graphql allows Retrieve Embedded Sensitive Data.This issue affects WPGraphQL: from n/a through 2.23.1.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00187 · Published 2026-10-13 · No fix listed CWE-862
Priority MEDIUM 58
WPGraphQL provides a GraphQL API for WordPress sites.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.0038 · Published 2026-09-23 · Fixed in 2.22.2 CWE-863
Priority HIGH 70
WPGraphQL provides a GraphQL API for WordPress sites.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00445 · Published 2026-07-31 · Fixed in 2.15.1 CWE-204
Priority LOW 32
Unauthenticated SQL Injection in WPGraphQL < 2.11.1 versions.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00251 · Published 2026-06-15 · Fixed in 2.11.1 CWE-89
Priority HIGH 77
WordPress Plugin WPGraphQL 1.3.5 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server resources by sending batched GraphQL queries with duplicated fields.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00451 · Published 2026-05-15 · No fix listed CWE-770
Priority LOW 23
Cross-Site Request Forgery (CSRF) vulnerability in WPGraphQL allows Cross Site Request Forgery.
CVSS 3.1MEDIUM 5.4· Network · No auth · User interaction · EPSS 0.00092 · Published 2026-05-07 · No fix listed CWE-352
Priority MEDIUM 53
WPGraphQL provides a GraphQL API for WordPress sites.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00184 · Published 2026-03-23 · Fixed in 2.10.0 CWE-862
Priority HIGH 69
WPGraphQL provides a GraphQL API for WordPress sites.
CVSS 3.1HIGH 7.7· Network · Low privileges · User interaction · EPSS 0.00944 · Published 2026-02-26 · Fixed in 2.9.1 CWE-78
Priority LOW 29
Server-Side Request Forgery (SSRF) vulnerability in WPGraphQL.This issue affects WPGraphQL: from n/a through 1.14.5.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.0045 · Published 2023-11-13 · Fixed in 1.14.6 CWE-918
Priority LOW 28
The WPGraphQL WordPress plugin before 0.3.5 doesn't properly restrict access to information about other users' roles on the affected site.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.01827 · Published 2022-05-09 · Fixed in 0.3.5 CWE-284
THREATIST.IORead the docs