CVE-2019-9880
An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users'...
CVE-2019-9880 is a critical vulnerability (CVSS 9.1) in Wpengine Wpgraphql, published June 10, 2019. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 34.8%, the 98th percentile. No source names a fixed version.
An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username.
- Record
CVE-2019-9880- CVSS 3.0
- 9.1 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:P/I:P/A:N - Weakness
- CWE-306
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username.
- Record
CVE-2019-9880- Updated
- 2026-11-02
EUVDEUVD-2019-19236 No score
An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username.
- Record
EUVD-2019-19236- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hmw5-56mv-q94w
An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users'...
An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username.
- Record
GHSA-hmw5-56mv-q94w- CVSS 3.0
- 9.1 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-306
- Updated
- 2026-11-02
OSV
An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username.
- Record
CVE-2019-9880- CVSS 3.0
- 9.1 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-04
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | WordPress Plugin WPGraphQL 0.2.3 - Multiple Vulnerabilities | 2019-05-21 |
| Nuclei | WPEngine WPGraphQL 0.2.3 - Unauthenticated User Information Disclosure |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-04 | facts | OSV |
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, Exploit-DB, GitHub Advisories, Nuclei, NVD, OSV |
References
wpvulndb.com/vulnerabilities/9282
packetstormsecurity.com/files/153025/WordPress-WPGraphQL-0.2.3-Authentication-Bypass-Information-Disclosure.html
pentestpartners.com/security-blog/pwning-wordpress-graphql
github.com/pentestpartners/snippets/blob/master/wp-graphql0.2.3_exploit.py
nvd.nist.gov/vuln/detail/CVE-2019-9880