CVE-2026-54768

WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts through the sendPasswordResetEmail mutation and obtain public profile fields. This issue is fixed in version 2.15.1.

Scoring

Severity

MEDIUM

CVSS base score

6.9

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

EPSS probability

0.28%

CWE

CWE-204

Published

2026-07-31

Last modified

2026-08-03

Affected products

• wp-graphql wp-graphql

Weakness type

• CWE-204

Related vulnerabilities

• CVE-2026-9161 — User Enumeration in DernekPlus' Website Template
• CVE-2026-86758 — Snipe-IT before 8.7.0 License Key Exposure via CSV Export
• CVE-2026-19205 — User Enumeration in GastroMenum's GastroMenum Web Panel
• CVE-2026-19080 — Username Enumeration in Menulux Software's Menulux Portal
• CVE-2026-78584 — Observable Response Discrepancy in Kibana Leading to Cross-Space Information Disclosure
• CVE-2026-84307 — Filament: Password validity disclosure for accounts denied panel access on login page
• CVE-2026-81033 — Automatisch through 0.15.0 User Enumeration via Forgot-Password Response Discrepancy
• CVE-2026-75575 — Rocket.Chat Missing DDP Rate Limit on the sendForgotPasswordEmail Meteor Method

Markdown version · Browse all CVEs