Vulnerabilities / WPGraphQL / WPSEC-2026-2523
WPGraphQL <= 2.26.0 - Unauthenticated Sensitive Information Exposure via REST-Exposed Settings
Medium 5.3
CWE-200Fixed in 2.26.1
- ID
- WPSEC-2026-2523
- Plugin
- WPGraphQL (wp-graphql)
- Affected
- all versions before 2.26.1
- Remediation
- Update to 2.26.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-11-04
- Attack surface
- WPGraphQL on WPSec AttackSurface
- Fix released
- Published
Description
The WPGraphQL plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.26.0 due to settings registered with 'show_in_rest' but not 'show_in_graphql' being exposed through the GraphQL settings fields without any capability requirement. This makes it possible for unauthenticated attackers to read plugin settings that WordPress only exposes to administrators through the REST API, which can include connector API key credentials. Exposure depends on which settings other plugins or connectors register for the REST API.
References
- https://wpsec.com/vuln/WPSEC-2026-2523/
- https://plugins.svn.wordpress.org/wp-graphql/tags/2.26.1/
- https://wordpress.org/plugins/wp-graphql/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS