← Database

CVE-2026-54768

N/A CVSS: N/A Published: 2026-07-31 Modified: 2026-08-03

Description

WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts through the sendPasswordResetEmail mutation and obtain public profile fields. This issue is fixed in version 2.15.1.

Affected Platforms

Unknown

Weakness Type

CWE-204

References