CVE-2019-9879

The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with...

9.8 CriticalPublic exploit

CVE-2019-9879 is a critical vulnerability (CVSS 9.8) in Wpengine Wpgraphql, published June 10, 2019. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 45.7%, the 98th percentile. No source names a fixed version.

The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever new user registrations are allowed. This is related to the registerUser mutation.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

45.7%Up 39.0 points since Apr 14, 2021

What each source reports

NVD Score used 9.8

Record: CVE-2019-9879
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-306
Updated: 2026-11-02

CVE List No score

Record: CVE-2019-9879
Updated: 2026-11-02

EUVDEUVD-2019-19235 No score

Record: EUVD-2019-19235
Updated: 2026-11-03

GitHub AdvisoriesGHSA-723x-w2r7-8wg2 9.8

The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with...

Record: GHSA-723x-w2r7-8wg2
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-306
Updated: 2026-11-02

OSV 9.8

Record: CVE-2019-9879
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-04

Affected products

wpengine wpgraphql

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	WordPress Plugin WPGraphQL 0.2.3 - Multiple Vulnerabilities	2019-05-21
Nuclei	WPGraphQL 0.2.3 - User Creation

History

History
When	Changed	Sources
2026-11-04	facts	OSV
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, Exploit-DB, GitHub Advisories, Nuclei, NVD, OSV