Description (CNA)
WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts through the sendPasswordResetEmail mutation and obtain public profile fields. This issue is fixed in version 2.15.1.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| wp-graphql / wp-graphql | affected < 2.15.1 |
CWE
CWE-204
References
- https://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-jhh7-832h-f8hv
- https://github.com/wp-graphql/wp-graphql/releases/tag/wp-graphql/v2.15.1
ADP enrichment
No English description supplied.