The WPGraphQL WooCommerce WordPress plugin before 0.12.4 does not prevent unauthenticated attackers from enumerating a shop's coupon codes and values via GraphQL.

Impact Users with capabilities to upload media (editors and above) are succeptible to SSRF (Server-Side Request Forgery) when executing the createMediaItem Mutation.

Authenticated users making GraphQL requests that execute the createMediaItem could pass executable paths in the mutations filePath argument that could give them unwarranted access to the server.

It's recommended to update to WPGraphQL v1.14.6 or newer. If you're unable to do so, below is a snippet you can add to your functions.php (or similar) that filters the createMediaItem mutation's resolver.

Patches

- v1.14.6 - https://github.com/wp-graphql/wp-graphql/pull/2840

Workarounds If you're unable to upgrade to v1.14.6 or higher, you should be able to use the following snippet in your functions.php to override the vulnerable resolver.

This snippet has been tested as far back as WPGraphQL v0.15

php addfilter( 'graphqlpreresolvefield', function( $nil, $source, $args, $context, \GraphQL\Type\Definition\ResolveInfo $info, $typename, $fieldkey, $field, $fieldresolver ) {

if ( $info->fieldName !== 'createMediaItem' ) { return $nil; }

$input = $args['input'] ?? null;

if ( ! isset( $input['filePath'] ) ) { return $nil; }

$uploadedfileurl = $input['filePath'];

// Check that the filetype is allowed $checkfile = wpcheckfiletype( $uploadedfileurl );

// if the file doesn't pass the check, throw an error if ( ! $checkfile['ext'] || ! $checkfile['type'] || ! wphttpvalidateurl( $uploadedfileurl ) ) { throw new \GraphQL\Error\UserError( sprintf( ( 'Invalid filePath "%s"', 'wp-graphql' ), $input['filePath'] ) ); }

$protocol = wpparseurl( $input['filePath'], PHPURLSCHEME );

// prevent the filePath from being submitted with a non-allowed protocols $allowedprotocols = [ 'https', 'http', 'file' ];

if ( ! inarray( $protocol, $allowedprotocols, true ) ) { throw new \GraphQL\Error\UserError( sprintf( ( 'Invalid protocol. "%1$s". Only "%2$s" allowed.', 'wp-graphql' ), $protocol, implode( '", "', $allowedprotocols ) ) ); }

return $nil;

}, 10, 9 );

References

- https://patchstack.com/database/vulnerability/wp-graphql/wordpress-wp-graphql-plugin-1-14-5-server-side-request-forgery-ssrf-vulnerability

The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled.

An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username.

The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever new user registrations are allowed. This is related to the registerUser mutation.