CVE-2019-9880

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username.

Metrics

CVSS 3.0 9.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/153025/WordPress-WPGraphQL-0.2.3-Authentication-Bypass-Information-Disclosure.htmlExploit, Third Party Advisory, VDB Entry
https://github.com/pentestpartners/snippets/blob/master/wp-graphql0.2.3_exploit.pyExploit, Third Party Advisory
https://github.com/wp-graphql/wp-graphql/releases/tag/v0.3.0Release Notes, Third Party Advisory
https://wpvulndb.com/vulnerabilities/9282Vendor Advisory
https://www.pentestpartners.com/security-blog/pwning-wordpress-graphql/Exploit, Third Party Advisory
http://packetstormsecurity.com/files/153025/WordPress-WPGraphQL-0.2.3-Authentication-Bypass-Information-Disclosure.htmlExploit, Third Party Advisory, VDB Entry
https://github.com/pentestpartners/snippets/blob/master/wp-graphql0.2.3_exploit.pyExploit, Third Party Advisory
https://github.com/wp-graphql/wp-graphql/releases/tag/v0.3.0Release Notes, Third Party Advisory
https://wpvulndb.com/vulnerabilities/9282Vendor Advisory
https://www.pentestpartners.com/security-blog/pwning-wordpress-graphql/Exploit, Third Party Advisory

Timeline

Published: Jun 10, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-98815.3The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even wh CVE-2019-98828.8Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to add malicious email sources into whitelist CVE-2019-98838.8Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to elevate privilege of specific account via CVE-2019-98849.8eClass platform < ip.2.5.10.2.1 allows an attacker to use GETS method to request /admin page to bypass the password validation and access ma CVE-2019-98859.8eClass platform < ip.2.5.10.2.1 allows an attacker to execute SQL command via /admin/academic/studenview_left.php StudentID parameter.CVE-2019-98867.5Any URLs with download_attachment.php under templates or home folders can allow arbitrary files downloaded without login in BroadLearning eC CVE-2019-98892.7In Vanilla before 2.6.4, a flaw exists within the getSingleIndex function of the AddonManager class. The issue results in a require call usi CVE-2019-98909.1An issue was discovered in GitLab Community and Enterprise Edition 10.x and 11.x before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.CVE-2019-98919.8The function getopt_simple as described in Advanced Bash Scripting Guide (ISBN 978-1435752184) allows privilege escalation and execution of CVE-2019-98926.5An issue was discovered in Open Ticket Request System (OTRS) 5.x through 5.0.34, 6.x through 6.0.17, and 7.x through 7.0.6. An attacker who CVE-2019-98939.8libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the arithmetic operators (LT, GT, LE, GE), whic CVE-2019-98947.5A remotely triggerable memory overwrite in RSA key exchange in PuTTY before 0.71 can occur before host key verification.