CyberRota Analysis
AI-GeneratedThe WPGraphQL plugin for WordPress versions 2.0.0 to 2.15.1 is vulnerable, allowing unauthenticated users to exploit the deprecated user field in the SendPasswordResetEmailPayload. This can lead to the exposure of existing author-class accounts and their public profile information through the sendPasswordResetEmail mutation. WordPress site administrators using affected versions should prioritize updating to version 2.15.1 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts through the sendPasswordResetEmail mutation and obtain public profile fields. This issue is fixed in version 2.15.1.