CVE-2019-9879: wordpress wp-graphql
Vulnerability summary
CVE-2019-9879 is a critical (CVSS 9.8) vulnerability in wordpress wp-graphql. EPSS estimates a 46.61% chance of exploitation in the next 30 days, higher than 98.8% of scored vulnerabilities. 4 public exploits are recorded. Fixed in 0.3.0.
Timeline
- 10-06-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever new user registrations are allowed. This is related to the registerUser mutation.
CVSS metrics
3 scores · 2 sources · 3 versionsEPSS trend
Probability
46.61%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
0.00 pp
From 46.61% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
4 foundSnippets
Maturity: poc
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
Exploit Reference (pentestpartners.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
- CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Affected systems
Wordpress1 product
- wp-graphql≤ 0.2.3 (fixed in 0.3.0)
Wpengine1 product
- wpgraphql0.2.3
2 vendors · 2 products
References
6 links- www.pentestpartners.com/security-blog/pwning-wordpress-graphql/X Refsource MISCExploitThird Party Advisory
- github.com/pentestpartners/snippets/blob/master/wp-graphql0.2.3_exploit.pyX Refsource MISCExploitThird Party Advisory
- github.com/wp-graphql/wp-graphql/releases/tag/v0.3.0X Refsource CONFIRMRelease NotesThird Party Advisory