CVE-2026-54768

Received Received - Intake

WPGraphQL Unauthenticated User Enumeration via SendPasswordResetEmail

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: GitHub, Inc.

Description

WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts through the sendPasswordResetEmail mutation and obtain public profile fields. This issue is fixed in version 2.15.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-31

Last Modified

2026-07-31

Generated

2026-08-01

AI Q&A

2026-08-01

EPSS Evaluated

N/A

NVD

CVE-2026-54768

Affected Vendors & Products

Vendor	Product	Version / Range
wpgraphql	wpgraphql	From 2.0.0 (inc) to 2.15.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-204	The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.

Attack-Flow Graph

Executive Summary

This vulnerability affects WPGraphQL, a GraphQL API for WordPress. In versions 2.0.0 to 2.15.1, an unauthenticated attacker can use the sendPasswordResetEmail mutation to check if an account with author privileges exists by observing the response. This allows them to identify existing author accounts and access public profile information.

Detection Guidance

This vulnerability can be detected by checking the WPGraphQL version installed on your WordPress site. If the version is between 2.0.0 and 2.15.0, the system is vulnerable. Use commands like 'wp plugin list' in WordPress CLI or check the plugin files for version details.

Impact Analysis

If you use WPGraphQL versions 2.0.0 to 2.15.1, an attacker could exploit this to determine which accounts have author privileges on your WordPress site. This could lead to targeted attacks, information gathering, or further exploitation of exposed profile data.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by exposing user account information through the sendPasswordResetEmail mutation. Unauthenticated attackers can distinguish existing author-class accounts and obtain public profile fields, which may lead to unauthorized data disclosure. This violates principles of data minimization and security under GDPR and HIPAA.

Mitigation Strategies

Immediately update WPGraphQL to version 2.15.1 or later. If updating is not possible, consider disabling the plugin temporarily until the update is applied. Review user accounts to ensure no unauthorized access has occurred.

Hi! I’m here to help you understand CVE-2026-54768. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70