An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username.
References
Configurations
History
No history.
Information
Published : 2019-06-10 18:29
Updated : 2024-11-21 04:52
NVD link : CVE-2019-9880
Mitre link : CVE-2019-9880
CVE.ORG link : CVE-2019-9880
JSON object : View
Products Affected
wpengine
- wpgraphql
CWE
CWE-306
Missing Authentication for Critical Function