CVE-2026-109703
5.3MediumPublished 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-862
Impact
Unauthenticated remote attackers can read sensitive embedded data over the network via GraphQL queries. Exploitation requires direct HTTP access to the WordPress site's GraphQL endpoint.
Root cause
WPGraphQL fails to perform proper authorization checks when querying embedded sensitive data.
Affected systems
WPGraphQL through 2.23.1
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Fix & remediation
Upgrade WPGraphQL to a version newer than 2.23.1 once available; if patching must wait, temporarily deactivate the wp-graphql plugin or restrict access to the /graphql endpoint at your reverse proxy.
$ wp plugin update wp-graphqlAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Missing Authorization vulnerability in WPGraphQL WPGraphQL wp-graphql allows Retrieve Embedded Sensitive Data.This issue affects WPGraphQL: from n/a through 2.23.1.