CVE-2026-54768
Low
Low
Medium
High
Critical
CVSS Score
Vulnerability Description
WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts through the sendPasswordResetEmail mutation and obtain public profile fields. This issue is fixed in version 2.15.1.
Severity Details
out of 10.0
Low
Weakness Type (CWE)
CWE-204
Observable Response Discrepancy
- Description
- The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.
- Typical Severity
- Medium
- Abstraction Level
- Base
Key Information
- Published Date
- July 31, 2026
