CVE-2019-25060: Improper Access Control in wp-graphql

medium Affects wp-graphql/wp-graphql, wpgraphql (WordPress plugin). Feed 2026.10.29.1, updated 2026-10-28; published 2022-05-09; advisory modified 2026-06-17.

Improper Access Control in wp-graphql

Package: wp-graphql/wp-graphql Composer
Affected versions: <0.3.5
Fixed in: 0.3.5
Severity: medium CVSS 5.3
Exploitation: not on CISA KEV · EPSS 2% (78.8th percentile)
Published: 2022-05-10
Source: osv.dev

References

The WPGraphQL WordPress plugin before 0.3.5 doesn't properly restrict access to information about other users' roles on the affected site. Because of this, a remote attacker could forge a GraphQL quer

Package: wpgraphql (WordPress plugin) WordPress
Affected versions: <0.3.5
Fixed in: 0.3.5
Severity: medium CVSS 5.3
Exploitation: not on CISA KEV · EPSS 2% (78.8th percentile)
Published: 2022-05-09
Source: nvd

References

CWE-284

NVD record wp-graphql/wp-graphql advisories wpgraphql (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden deps composer.lock

Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command

Install docs How findings are ranked

Related advisories

CVE-2023-23684 medium WPGraphQL Plugin vulnerable to Server Side Request Forgery (SSRF) same package: wp-graphql/wp-graphql
CVE-2026-54768 medium WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user exi same package: wp-graphql/wp-graphql
CVE-2026-88974 medium WPGraphQL: Contributor can publish and modify posts without the required capabilities via same package: wp-graphql/wp-graphql
CVE-2019-9879 critical The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user wi same package: wpgraphql (WordPress plugin)
CVE-2019-9880 critical An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'user same package: wpgraphql (WordPress plugin)
CVE-2019-9881 medium The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthentica same package: wpgraphql (WordPress plugin)