VULNERABILITY INTELLIGENCE
CVE-2026-54768
EPSS probability0.45%
CISA KEVNot currently listed
Published2026-07-31
Last modified2026-09-10
Description
WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts through the sendPasswordResetEmail mutation and obtain public profile fields. This issue is fixed in version 2.15.1.
Weakness classification
- security-advisories@github.com: CWE-204