Technical impact
WPGraphQL provides a GraphQL API for WordPress sites. From version 2.0.0 through 2.15.0, the deprecated user field on SendPasswordResetEmailPayload can be accessed by an unauthenticated caller via the sendPasswordResetEmail mutation. This field allows the attacker to determine whether a username belongs to an author-class account and to retrieve public profile fields, thereby leaking user existence and profile information. The vulnerability is reflected by CWE-204, which addresses disclosure of user data through incorrect design. The issue was fixed in version 2.15.1.
Affected Systems
The affected product is the WPGraphQL plugin for WordPress. Versions from 2.0.0 through 2.15.0 (inclusive) contain the vulnerable deprecated field; the issue was addressed in version 2.15.1.
Risk and Exploitability
The CVSS score of 6.9 indicates moderate severity, while the EPSS score of less than 1% suggests that the likelihood of exploitation is low at present. The vulnerability is accessible without authentication, making it a remote attack vector. It is not listed in CISA's KEV catalog. An attacker can send a crafted GraphQL request to the sendPasswordResetEmail mutation and observe whether a user exists, thereby enabling enumeration and profile leakage. Given the low EPSS and the lack of advanced persistence mechanisms, the risk remains moderate but unchanged.
Github GHSA