CVE-2019-25060
CVE-2019-25060 · WP-GraphQL < 0.3.5 - Improper Access Control
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The WPGraphQL WordPress plugin before 0.3.5 doesn't properly restrict access to information about other users' roles on the affected site. Because of this, a remote attacker could forge a GraphQL query to retrieve the account roles of every user on the site.
CVSS 5.3 · Medium · EPSS 1.8% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
wpgraphql
- Versions
- ≥ 0.3.5, < 0.3.5: Affected (custom)
No fix published
wp-graphql/wp-graphql Packagist
- Versions
- 0.0.2
- 0.0.20
- 0.0.21
- 0.0.22
- 0.0.23
- 0.0.24
- 0.0.25
- 0.0.26
- 0.0.27
- 0.0.28
- 0.0.29
- 0.0.3
- 0.0.30
- 0.0.31
- 0.0.5
- v0.0.10
- v0.0.11
- v0.0.12
- v0.0.13
- v0.0.14
- v0.0.15
- v0.0.16
- v0.0.17
- v0.0.18
- v0.0.19
- v0.0.32
- v0.0.33
- v0.0.34
- v0.0.6
- v0.0.7
- v0.0.8
- v0.0.9
- v0.1.0
- v0.1.1
- v0.1.2
- v0.1.3
- v0.1.4
- v0.2.0
- v0.2.1
- v0.2.2
- v0.2.3
- v0.3.0
- v0.3.01
- v0.3.2
- v0.3.3
- v0.3.4
- Affected ranges
- ECOSYSTEM: < 0.3.5
Update to 0.3.5