CVE-2023-23684: WordPress WPGraphQL Plugin <= 1.14.5 is vulnerable to Server Side Request Forgery (SSRF)
First published: Fri Jun 30 2023(Updated: )
Server-Side Request Forgery (SSRF) vulnerability in WPGraphQL.This issue affects WPGraphQL: from n/a through 1.14.5.
Credit: audit@patchstack.com audit@patchstack.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/wp-graphql/wp-graphql | <=1.14.5 | 1.14.6 |
| Wpgraphql Wpgraphql | <=1.14.5 | |
| Wpengine Wpgraphql | <=1.14.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://patchstack.com/database/vulnerability/wp-graphql/wordpress-wp-graphql-plugin-1-14-5-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
- https://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-cfh4-7wq9-6pgg
- https://github.com/wp-graphql/wp-graphql/pull/2840
- https://github.com/wp-graphql/wp-graphql/releases/tag/v1.14.6
- https://nvd.nist.gov/vuln/detail/CVE-2023-23684
- https://github.com/advisories/GHSA-cfh4-7wq9-6pgg (Advisory)
Frequently Asked Questions
What is the vulnerability ID for this WordPress WPGraphQL vulnerability?
The vulnerability ID for this WordPress WPGraphQL vulnerability is CVE-2023-23684.
What is the impact of this vulnerability?
Users with capabilities to upload media are susceptible to Server Side Request Forgery (SSRF) when executing the createMediaItem Mutation.
Which version of WordPress WPGraphQL Plugin is affected by this vulnerability?
WordPress WPGraphQL Plugin version 1.14.5 is affected by this vulnerability.
How severe is this vulnerability?
This vulnerability has a severity score of 6.5, which is categorized as medium.
How can I fix this vulnerability?
To fix this vulnerability, update your WordPress WPGraphQL Plugin to version 1.14.6 or later.
- collector/mitre-cve
- collector/github-advisory-latest
- alias/GHSA-cfh4-7wq9-6pgg
- alias/CVE-2023-23684
- collector/nvd-cve
- collector/github-advisory
- collector/nvd-api
- package-manager/composer
- vendor/wpgraphql
- canonical/wpgraphql wpgraphql
- version/wpgraphql wpgraphql/1.14.5
- vendor/wpengine
- canonical/wpengine wpgraphql
- version/wpengine wpgraphql/1.14.5