CVE-2026-54768 Overview
CVE-2026-54768 affects WPGraphQL, a plugin that provides a GraphQL API for WordPress sites. Versions from 2.0.0 up to (but not including) 2.15.1 expose a deprecated user field on the SendPasswordResetEmailPayload type. An unauthenticated caller can invoke the sendPasswordResetEmail mutation and distinguish existing author-class accounts. The response also returns public profile fields for those accounts. The issue is an observable discrepancy information exposure flaw [CWE-204] and is fixed in WPGraphQL 2.15.1.
Critical Impact
Unauthenticated attackers can enumerate valid WordPress author-class usernames and harvest public profile data through the GraphQL API, enabling targeted credential attacks.
Affected Products
- WPGraphQL plugin for WordPress, versions 2.0.0 through 2.15.0
- WordPress sites exposing the WPGraphQL endpoint publicly
- Deployments relying on the deprecated user field in SendPasswordResetEmailPayload
Discovery Timeline
- 2026-07-31 - CVE-2026-54768 published to NVD
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2026-54768
Vulnerability Analysis
WPGraphQL exposes the sendPasswordResetEmail mutation for initiating password recovery flows. The mutation returns a SendPasswordResetEmailPayload object that includes a deprecated user field. When a caller supplies a username or email belonging to an author-class account, the response resolves the user field with public profile data. When the account does not exist, the field resolves to null. This observable behavioral difference lets attackers determine which usernames or email addresses map to real accounts without authenticating.
The issue is classified as CWE-204 (Observable Response Discrepancy). It does not compromise passwords directly, but it removes a barrier that normally protects account enumeration. Attackers gain a reliable oracle for building target lists prior to brute-force or credential-stuffing attempts.
Root Cause
The mutation resolver populates the deprecated user field with author-visible profile data before returning to the caller. The resolver does not equalize responses between valid and invalid inputs. Because the endpoint is reachable without authentication, any unauthenticated GraphQL client can observe the discrepancy across many candidate identifiers.
Attack Vector
An attacker sends unauthenticated GraphQL mutation requests to the WPGraphQL endpoint, iterating through candidate usernames or email addresses. Responses containing a populated user object confirm account existence and disclose public profile fields such as display name, slug, and other author metadata. The attack requires only network access to the WordPress site and no user interaction.
See the GitHub Security Advisory GHSA-jhh7-832h-f8hv for the vendor's technical description.
Detection Methods for CVE-2026-54768
Indicators of Compromise
- High volume of sendPasswordResetEmail mutation requests from a single source IP or narrow IP range
- GraphQL queries that explicitly select the deprecated user field on SendPasswordResetEmailPayload
- Sequential or dictionary-style variation in the username or email argument across short time windows
- Unauthenticated POST traffic to /graphql with password-reset payloads outside normal user behavior
Detection Strategies
- Parse web server and application logs for POST requests to the GraphQL endpoint containing sendPasswordResetEmail and user { ... } selections.
- Rate-alert on repeated password-reset mutations from the same client identifier within a short interval.
- Correlate GraphQL mutation activity with subsequent WordPress login failures from the same source to identify enumeration-to-brute-force chains.
Monitoring Recommendations
- Enable verbose logging on the WPGraphQL endpoint including request bodies and response status.
- Forward WordPress and reverse-proxy logs to a centralized analytics platform for baselining and anomaly detection.
- Track the installed WPGraphQL version across all WordPress properties and alert when versions below 2.15.1 are detected.
How to Mitigate CVE-2026-54768
Immediate Actions Required
- Upgrade WPGraphQL to version 2.15.1 or later on every WordPress site running the plugin.
- Inventory all WordPress deployments and confirm the WPGraphQL endpoint is not exposed to untrusted networks unless required.
- Review recent access logs for enumeration patterns against the sendPasswordResetEmail mutation and rotate credentials for any exposed author accounts.
Patch Information
The maintainers fixed the issue in WPGraphQL 2.15.1 by removing the disclosure path on the deprecated user field. Details are in the GitHub Release wp-graphql v2.15.1 and the GitHub Security Advisory GHSA-jhh7-832h-f8hv.
Workarounds
- Restrict access to the /graphql endpoint using web application firewall rules or IP allow-lists until the plugin is upgraded.
- Apply rate limiting to sendPasswordResetEmail mutations at the reverse proxy or WAF layer to slow enumeration attempts.
- Disable the WPGraphQL plugin if it is not actively required by the site's functionality.
# Configuration example: upgrade WPGraphQL via WP-CLI
wp plugin update wp-graphql --version=2.15.1
wp plugin get wp-graphql --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
