CVE-2019-9880
WPGraphQL <= 0.2.3 - Information Exposure
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
5Exploited in Wild
-Decision
Descriptions
An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username.
Se descubrió un problema en el plugin WPGraphQL 0.2.3 para WordPress. Consultando los usuarios RootQuery, esto es posible por un atacante sin identificar, para recuperar todos los detalles de los usuarios WordPress, como direcciones de email, administrador, y nombre de usuario
An issue was discovered in WPGraphQL up to 0.2.3 . By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username.
WordPress WPGraphQL plugin version 0.2.3 suffers from authentication bypass and information disclosure vulnerabilities.
CVSS Scores
SSVC
- Decision:Attend
Timeline
- 2019-03-19 CVE Reserved
- 2019-05-08 CVE Published
- 2019-05-21 First Exploit
- 2024-11-15 CVE Updated
- 2024-12-17 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
- CWE-306: Missing Authentication for Critical Function
CAPEC
References (7)
| URL | Tag | Source |
|---|---|---|
| https://github.com/wp-graphql/wp-graphql/releases/tag/v0.3.0 | Release Notes |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://wpvulndb.com/vulnerabilities/9282 | 2024-01-22 |