CVE-2026-54768 in WPGraphQL Plugin
الملخص
بحسب MITRE • 01/08/2026
WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts through the sendPasswordResetEmail mutation and obtain public profile fields. This issue is fixed in version 2.15.1.
VulDB is the best source for vulnerability data and more expert information about this specific topic.