GCVE - cpe:2.3:a:wpengine:wpgraphql:0.2.3:*:*:*:*:wordpress:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:wpengine:wpgraphql:0.2.3:*:*:*:*:wordpress:*:*

part: a version: 0.2.3 update: *

Vendor	Wpengine (`e497888d-6961-5f9a-82ea-2da6d8712318`)
Product	Wpgraphql (`78481cae-9926-5f59-a9aa-f08c90b5e3c3`)
Edition	*
Language	*
Software edition	*
Target software	wordpress
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/wp-graphql/wp-graphql`	purl2cpe	2026-06-01 10:12:40.737291

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2019-9881`	vulnerable	2026-06-08 05:14:26.367352	Details available The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled. Published: 2019-06-10T17:37:26.000Z Updated: 2024-08-04T22:01:55.083Z Open on db.gcve.eu Reference links https://wpvulndb.com/vulnerabilities/9282 http://packetstormsecurity.com/files/153025/WordPress-WPGraphQL-0.2.3-Authentication-Bypass-Information-Disclosure.html https://www.pentestpartners.com/security-blog/pwning-wordpress-graphql/ https://github.com/pentestpartners/snippets/blob/master/wp-graphql0.2.3_exploit.py https://github.com/wp-graphql/wp-graphql/releases/tag/v0.3.0	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-9880`	vulnerable	2026-06-08 05:14:26.366887	Details available An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username. Published: 2019-06-10T17:32:39.000Z Updated: 2024-11-15T15:18:44.814Z Open on db.gcve.eu Reference links https://wpvulndb.com/vulnerabilities/9282 http://packetstormsecurity.com/files/153025/WordPress-WPGraphQL-0.2.3-Authentication-Bypass-Information-Disclosure.html https://www.pentestpartners.com/security-blog/pwning-wordpress-graphql/ https://github.com/pentestpartners/snippets/blob/master/wp-graphql0.2.3_exploit.py https://github.com/wp-graphql/wp-graphql/releases/tag/v0.3.0	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-9879`	vulnerable	2026-06-08 05:14:26.366114	Details available The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever new user registrations are allowed. This is related to the registerUser mutation. Published: 2019-06-10T17:28:53.000Z Updated: 2024-08-04T22:01:55.007Z Open on db.gcve.eu Reference links https://wpvulndb.com/vulnerabilities/9282 http://packetstormsecurity.com/files/153025/WordPress-WPGraphQL-0.2.3-Authentication-Bypass-Information-Disclosure.html https://www.pentestpartners.com/security-blog/pwning-wordpress-graphql/ https://github.com/pentestpartners/snippets/blob/master/wp-graphql0.2.3_exploit.py https://github.com/wp-graphql/wp-graphql/releases/tag/v0.3.0	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.