The vulnerability is a missing authorization flaw in the WPGraphQL WordPress plugin. An attacker can request GraphQL queries against the plugin’s endpoint and retrieve embedded sensitive data that should only be available to authenticated users. The flaw does not allow code execution or privilege escalation, but it exposes confidential information, potentially compromising the privacy of site users and the integrity of internal data.

WordPress sites using the WPGraphQL plugin version 2.23.1 or earlier are affected. The vulnerability applies to all releases from the plugin’s first version up to and including 2.23.1. The affected vendor is WPGraphQL.

The CVSS score of 5.3 indicates a moderate severity. The event probability score (EPSS) is not available, so it is unclear how often the vulnerability is exploited, but the issue is not listed in CISA’s KEV catalog. The attack vector is inferred to be the public GraphQL endpoint (wp-graphql) because the plugin does not enforce proper authentication checks for certain queries. If an attacker can reach the endpoint, the missing authorization control allows them to extract sensitive data. The risk of exploitation depends on the plugin’s exposure to the public internet and the sensitivity of the exposed data.