DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-54768: CVE-2026-54768: User Enumeration and Profile Leak in WPGraphQL via Deprecated Field Resolver

#security #cve #cybersecurity

CVE-2026-54768: User Enumeration and Profile Leak in WPGraphQL via Deprecated Field Resolver

Vulnerability ID: CVE-2026-54768
CVSS Score: 6.9
Published: 2026-07-31

An observable response discrepancy vulnerability in WPGraphQL versions 2.0.0 through 2.15.0 allows unauthenticated remote attackers to enumerate users and extract public profile metadata. Although the password reset mutation is designed to return a uniform success response to prevent enumeration, a legacy deprecated field resolver bypasses this mechanism by resolving the associated user profile if the target account exists.

TL;DR

A deprecated field resolver in WPGraphQL's password reset mutation leaks user existence and profile metadata, undermining anti-enumeration controls.

Technical Details

  • CWE ID: CWE-204
  • Attack Vector: Network
  • CVSS v4.0: 6.9 (Medium)
  • Exploit Status: Proof of Concept Available
  • CISA KEV Status: Not Listed
  • Ransomware Association: No Known Use
  • Impact: Unauthenticated Username Enumeration and Metadata Disclosure

Affected Systems

  • WPGraphQL (WordPress Plugin) versions 2.0.0 through 2.15.0
  • WPGraphQL: >= 2.0.0, < 2.15.1 (Fixed in: 2.15.1)

Mitigation Strategies

  • Upgrade the WPGraphQL plugin to the non-vulnerable version 2.15.1 or later.
  • Apply a manual code hotfix to prevent the deprecated resolver from processing the internal ID field.
  • Implement WAF rules to block incoming queries matching the enumeration mutation signature.

Remediation Steps:

  1. Locate the active installation of WPGraphQL on your WordPress server.
  2. Perform a clean update to version 2.15.1 using the WordPress Admin interface, WP-CLI, or Composer.
  3. If manual hotfixing is necessary, open 'src/Deprecated.php' and locate the 'SendPasswordResetEmailPayload' configuration.
  4. Modify the 'resolve' callback on the 'user' field definition to return null unconditionally.
  5. Open 'src/Mutation/SendPasswordResetEmail.php' and set the returned 'id' field to null in the success payload return array.
  6. Deploy WAF rule pattern 'mutation.sendPasswordResetEmail.*user\s{' to reject unauthorized enumeration requests.

Read the full report for CVE-2026-54768 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)