# WPGraphQL <= 2.26.0 - Unauthenticated Sensitive Information Exposure via REST-Exposed Settings

- **ID:** WPSEC-2026-2523
- **Plugin:** WPGraphQL (`wp-graphql`), https://wordpress.org/plugins/wp-graphql/
- **Affected versions:** all versions before 2.26.1
- **Fixed in:** 2.26.1 (Update to 2.26.1 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-11-04)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-graphql
- **Fix released:** 2026-11-03
- **Published:** 2026-11-04
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2523/

## Description

The WPGraphQL plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.26.0 due to settings registered with 'show_in_rest' but not 'show_in_graphql' being exposed through the GraphQL settings fields without any capability requirement. This makes it possible for unauthenticated attackers to read plugin settings that WordPress only exposes to administrators through the REST API, which can include connector API key credentials. Exposure depends on which settings other plugins or connectors register for the REST API.

## References

- https://wpsec.com/vuln/WPSEC-2026-2523/
- https://plugins.svn.wordpress.org/wp-graphql/tags/2.26.1/
- https://wordpress.org/plugins/wp-graphql/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2523/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.