CVE-2026-54768 WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)
Unauthenticated attackers can enumerate existing author accounts and retrieve public profile data via the password reset mutation, bypassing anti-enumeration controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-54768?
CVE-2026-54768 is a medium-severity vulnerability in wp-graphql, published on 31 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts through the sendPasswordResetEmail mutation and obtain public profile fields. This issue is fixed in version 2.15.1.
Weakness: CWE-204
Which versions are affected by CVE-2026-54768?
2 open source packages ship an affected version, including wp-graphql/wp-graphql.
| Package | Affected | Fixed in |
|---|---|---|
wp-graphql/wp-graphql Packagist | All versions to 2.6.0 | None |
wp-graphql/wp-graphql Packagist | All versions to 2.6.0 | None |
How do I fix CVE-2026-54768?
No fix has been published for CVE-2026-54768 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-54768 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-54768 exists.
Sources
Also known as GHSA-jhh7-832h-f8hv.