CVE-2019-9880: wordpress wp-graphql
Vulnerability summary
CVE-2019-9880 is a critical (CVSS 9.1) vulnerability in wordpress wp-graphql. EPSS estimates a 35.64% chance of exploitation in the next 30 days, higher than 98.4% of scored vulnerabilities. 4 public exploits are recorded. Fixed in 0.3.0.
Timeline
- 10-06-2019PublishedVulnerability first disclosed.
- 15-11-2024Last modifiedVulnerability information updated.
Description
An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username.
CVSS metrics
3 scores · 2 sources · 3 versionsEPSS trend
Probability
35.64%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
+17.89 pp
From 17.75% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
4 foundSnippets
Maturity: poc
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
Exploit Reference (pentestpartners.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Affected systems
Wordpress1 product
- wp-graphql≤ 0.2.3 (fixed in 0.3.0)
Wpengine1 product
- wpgraphql0.2.3
2 vendors · 2 products
References
6 links- www.pentestpartners.com/security-blog/pwning-wordpress-graphql/X Refsource MISCExploitThird Party Advisory
- github.com/pentestpartners/snippets/blob/master/wp-graphql0.2.3_exploit.pyX Refsource MISCExploitThird Party Advisory
- github.com/wp-graphql/wp-graphql/releases/tag/v0.3.0X Refsource CONFIRMRelease NotesThird Party Advisory