CVE-2026-54768Medium▾ SunlitWPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts through the sendPasswordR…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
0.3% → 0.4%
WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts through the sendPasswordResetEmail mutation and obtain public profile fields. This issue is fixed in version 2.15.1.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
wp-graphql/wp-graphql <= 2.6.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-88974Medium· 5.4WPGraphQL provides a GraphQL API for WordPress sites
CVE-2026-107843Medium· 5.3Contao is an Open Source CMS
CVE-2026-84307Low· 3.7Filament is a collection of full-stack components for accelerated Laravel development
GHSA-gq4g-fpc9-vjfqLowWebauthn: SimpleFakeCredentialGenerator with an empty secret produces predictable fake credentials, weakening username enumeration protection
GHSA-j7f5-gfqm-pcx3MediumPterodactyl Panel: Client email change endpoint allows enumeration of accounts in system
CVE-2026-100164High· 7.5User Enumeration in Rolantis Information Technologies' Agentis