{
 "id": "WPSEC-2026-2523",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2523/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2523/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2523/index.md",
 "title": "WPGraphQL <= 2.26.0 - Unauthenticated Sensitive Information Exposure via REST-Exposed Settings",
 "description": "The WPGraphQL plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.26.0 due to settings registered with 'show_in_rest' but not 'show_in_graphql' being exposed through the GraphQL settings fields without any capability requirement. This makes it possible for unauthenticated attackers to read plugin settings that WordPress only exposes to administrators through the REST API, which can include connector API key credentials. Exposure depends on which settings other plugins or connectors register for the REST API.",
 "plugin": {
  "slug": "wp-graphql",
  "name": "WPGraphQL",
  "full_name": "WPGraphQL",
  "wordpress_org": "https://wordpress.org/plugins/wp-graphql/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-graphql/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-graphql"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.26.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.26.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.26.1",
 "remediation": "Update to 2.26.1 or later.",
 "fix_released": "2026-11-03T20:48:19+00:00",
 "published": "2026-11-04T21:42:17+00:00",
 "updated": "2026-11-04T13:59:04.037721+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2523/",
  "https://plugins.svn.wordpress.org/wp-graphql/tags/2.26.1/",
  "https://wordpress.org/plugins/wp-graphql/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-graphql",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-11-04"
 }
}