We’re taking on a small number of new builds and rebuilds this quarter. Book a call to see if your project is a fit.

CVE CVE-2026-54768

CVE-2026-54768

WordPress

Severity: —
CVSS: —CVSS
Published: 2026-07-31
Last modified: 2026-07-31
CWE: CWE-204

Description

WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts through the sendPasswordResetEmail mutation and obtain public profile fields. This issue is fixed in version 2.15.1.

References

https://github.com/wp-graphql/wp-graphql/releases/tag/wp-graphql/v2.15.1
https://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-jhh7-832h-f8hv

Summary

Description

References