⚠ Exploited in the wild
Exploitation observed in the wild. Not yet on CISA KEV.
CVE-2019-9880 — Missing Authentication for Critical Function in Wpgraphql
Severity
9.1CRITICALNVD
EPSS
73.4%
top 1.19%
CISA KEV
Not in KEV
Exploit
Exploited in wild
Active exploitation observed
Affected products
Timeline
PublishedJun 10
Latest updateMay 24
Description
An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NExploitability: 3.9 | Impact: 5.2
Affected Packages1 packages
🔴Vulnerability Details
2💥Exploits & PoCs
2Nuclei▶
WPEngine WPGraphQL 0.2.3 - Unauthenticated User Information Disclosure