CVE-2026-109703: WordPress WPGraphQL plugin <= 2.23.1 - Sensitive Data Exposure vulnerability
Missing Authorization vulnerability in WPGraphQL WPGraphQL wp-graphql allows Retrieve Embedded Sensitive Data.This issue affects WPGraphQL: from n/a through 2.23.1.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
The CVSS vector indicates that exploitation is network-accessible, requires no privileges, and does not require user interaction. An unauthenticated remote attacker can potentially retrieve embedded sensitive data.
What is the impact of successful exploitation?
The reported impact is limited to confidentiality. The CVSS vector indicates low confidentiality impact, with no integrity or availability impact.
Which WPGraphQL versions are affected?
WPGraphQL versions through 2.23.1 are affected. The supplied data does not identify a fixed version.
Are default installations affected?
The available information does not state whether a default WPGraphQL configuration is affected or identify any configuration prerequisite.