CVE-2019-9880
First published: Mon Jun 10 2019(Updated: )
An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Wpgraphql Wpgraphql | =0.2.3 | |
| Wpengine Wpgraphql | =0.2.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://packetstormsecurity.com/files/153025/WordPress-WPGraphQL-0.2.3-Authentication-Bypass-Information-Disclosure.html
- https://github.com/pentestpartners/snippets/blob/master/wp-graphql0.2.3_exploit.py
- https://github.com/wp-graphql/wp-graphql/releases/tag/v0.3.0
- https://wpvulndb.com/vulnerabilities/9282
- https://www.pentestpartners.com/security-blog/pwning-wordpress-graphql/
Frequently Asked Questions
What is CVE-2019-9880?
CVE-2019-9880 is a vulnerability in the WPGraphQL 0.2.3 plugin for WordPress that allows an unauthenticated attacker to retrieve all WordPress user details.
How severe is CVE-2019-9880?
CVE-2019-9880 has a severity score of 9.1, which is classified as critical.
Which software version is affected by CVE-2019-9880?
WPGraphQL 0.2.3 is the affected version of the plugin.
How can an attacker exploit CVE-2019-9880?
By querying the 'users' RootQuery, an unauthenticated attacker can retrieve all WordPress user details such as email address, role, and username.
Is there a fix available for CVE-2019-9880?
Yes, a fix is available in WPGraphQL version 0.3.0, which should be updated to mitigate the vulnerability.
- collector/nvd-index
- agent/type
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/references
- agent/last-modified-date
- agent/author
- agent/weakness
- agent/severity
- agent/tags
- agent/softwarecombine
- agent/description
- agent/event
- collector/mitre-cve
- source/MITRE
- vendor/wpgraphql
- canonical/wpgraphql wpgraphql
- version/wpgraphql wpgraphql/0.2.3
- vendor/wpengine
- canonical/wpengine wpgraphql
- version/wpengine wpgraphql/0.2.3