wp-graphql v2.15.1 User Enumeration Vulnerability via SendPasswordResetEmail (GHSA-jhh7-832h-88hy)

Vulnerability Overview A user enumeration vulnerability was identified in version 2.15.1. This vulnerability exists in the mutation, specifically within the field. This field may expose whether a specific username or email address belongs to a registered account (and expose backend class user data) to unauthorized requests. Affected Scope Affected Versions: v2.15.1 Vulnerability Type: User Enumeration Potential Risk: Attackers can use this vulnerability to determine whether a username or email address corresponds to a registered account, potentially facilitating further attacks. Remediation Remediation Measure: The field now only returns data under the permission. For callers who cannot list users, the field returns . Reference Link: GHSA-jhh7-832h-88hy (CVE pending) Additional Information Publication Date: 2026-06-09 Publisher: jasonbahl Other Fixes: - Deploy WordPress.org assets via ASSETS_DIR + dedicated asset update workflow (#5880) (#50161) Assets schema.graphql: SHA256: 5f832f13f42159f0e2f4f0fb..., Size: 384 KB, Publication Date: Jun 10 wp-graphql.zip: SHA256: af534bf38af12169d5c9079b37..., Size: 1.66 MB, Publication Date: Jun 10 Source code (zip): Publication Date: Jun 10 Source code (tar.gz): Publication Date: Jun 10 Summary Version 2.15.1 of contains a user enumeration vulnerability where user information is exposed through the field of the mutation. The remediation restricts the field to return data only when the permission is granted. Users are advised to upgrade to the latest version as soon as possible to address this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

wp-graphql v2.15.1 User Enumeration Vulnerability via SendPasswordResetEmail (GHSA-jhh7-832h-88hy)

More from this source