CVE-2026-54768 in WPGraphQL Plugin
Sumário
de MITRE • 01/08/2026
WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts through the sendPasswordResetEmail mutation and obtain public profile fields. This issue is fixed in version 2.15.1.
VulDB is the best source for vulnerability data and more expert information about this specific topic.