CVE-2019-25060 WP-GraphQL < 0.3.5 - Improper Access Control
Remote attackers can retrieve user role information via GraphQL queries, exposing sensitive account details in WPGraphQL.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-25060?
CVE-2019-25060 is a medium-severity vulnerability in Unknown WPGraphQL, published on 9 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The WPGraphQL WordPress plugin before 0.3.5 doesn't properly restrict access to information about other users' roles on the affected site. Because of this, a remote attacker could forge a GraphQL query to retrieve the account roles of every user on the site.
Weakness: CWE-284
Which versions are affected by CVE-2019-25060?
2 open source packages ship an affected version, including wp-graphql/wp-graphql. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
wp-graphql/wp-graphql Packagist | All versions | 0.3.5 |
wp-graphql/wp-graphql Packagist | All versions | 0.3.5 |
Products include Wpgraphql Wpgraphql.
How do I fix CVE-2019-25060?
Upgrade wp-graphql/wp-graphql to 0.3.5 or later.
Is CVE-2019-25060 being exploited?
There is no known exploitation of CVE-2019-25060 in the wild and no public exploit code.
Sources
Also known as GHSA-w3xg-7q6m-3xwp.