Wpengine Wpgraphql vulnerabilities

5 vulnerabilities

Known vulnerabilities in Wpengine Wpgraphql, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

5.3CVE-2022-1563unknownwp-graphql-woocommerce+2
EPSS score
0.72%
The WPGraphQL WooCommerce WordPress plugin before 0.12.4 does not prevent unauthenticated attackers from enumerating a shop's coupon codes and values via GraphQL.9.1CVE-2019-9880wordpresswp-graphql+1
EPSS score
35.64%
An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username.5.3CVE-2019-9881wordpresswp-graphql+1
EPSS score
18.83%
The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled.9.8CVE-2019-9879wordpresswp-graphql+1
EPSS score
46.61%
The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever new user registrations are allowed. This is related to the registerUser mutation.6.5CVE-2023-23684wordpresswp-graphql+2
EPSS score
0.45%
Server-Side Request Forgery (SSRF) vulnerability in WPGraphQL.This issue affects WPGraphQL: from n/a through 1.14.5.