Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| wp-graphql/wp-graphql | composer | <= 2.6.0 |
Miggo AIRoot Cause AnalysisThe vulnerability exists due to a combination of two factors. First, the sendPasswordResetEmail mutation resolver, specifically the closure returned by WPGraphQL\Mutation\SendPasswordResetEmail::mutate_and_get_payload, includes the internal user ID in its return payload when a provided username or email matches an existing user. While this mutation correctly always returns success: true to prevent direct enumeration, the inclusion of the user ID creates a side-channel.
Second, a deprecated user field on the SendPasswordResetEmailPayload has a resolver that takes this user ID and fetches the full user object. This resolver, an anonymous function within register_graphql_field in src/Deprecated.php, did not have any capability checks. Consequently, an unauthenticated attacker could query the sendPasswordResetEmail mutation and request the deprecated user field. If the user existed, the field would return user details; if not, it would return null. This discrepancy allows for user enumeration and disclosure of public profile information, defeating the primary anti-enumeration goal of the mutation.
The patch addresses the root cause in the user field resolver by adding a current_user_can('list_users') check, ensuring that only users with sufficient privileges can resolve the user object, effectively closing the information disclosure vector for unauthenticated or low-privileged users.
WPGraphQL\Mutation\SendPasswordResetEmail::mutate_and_get_payloadplugins/wp-graphql/src/Mutation/SendPasswordResetEmail.php
(anonymous function) in register_graphql_fieldplugins/wp-graphql/src/Deprecated.php