wp-graphql has 2 CVEs on record. 1 was published in the last 90 days. The median CVSS is 5.4 (medium).
CVEs per month
Last 12 months, by publish date
1125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/10
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.4
- Publish → KEV
- —
- Last 90 days
- 1 prev 1
2
Total CVEs
0
Critical
0
CISA KEV
0
Exploited
wp-graphql vulnerabilities
CVEs affecting wp-graphql, newest first. Open any entry for full detail, references, and exploit status.
2 CVEsRSS
CVE-2026-88974Medium· 5.4PoCWPGraphQL provides a GraphQL API for WordPress sites
WPGraphQL provides a GraphQL API for WordPress sites. Prior to 2.22.2, the updatePost mutation in src/Mutation/PostObjectUpdate.php checks only the collection-level edit_posts capability and the post author, but does not enforce the obje…
▾ Twilightwp-graphql · wp-graphqlEPSS 0.38%via NVD
CVE-2026-54768MediumWPGraphQL provides a GraphQL API for WordPress sites
WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts through the sendPasswordR…
▾ Sunlitwp-graphql · wp-graphql/wp-graphqlEPSS 0.45%via NVD