CVE-2019-9881
The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated...
CVE-2019-9881 is a medium vulnerability (CVSS 5.3) in Wpengine Wpgraphql, published June 10, 2019. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 18.4%, the 97th percentile. No source names a fixed version.
The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled.
- Record
CVE-2019-9881- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-306
- Updated
- 2026-11-02
CVE List No score
The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled.
- Record
CVE-2019-9881- Updated
- 2026-11-02
EUVDEUVD-2019-19237 No score
The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled.
- Record
EUVD-2019-19237- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hhwc-x32h-p6qg
The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated...
The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled.
- Record
GHSA-hhwc-x32h-p6qg- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-306
- Updated
- 2026-11-02
OSV
The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled.
- Record
CVE-2019-9881- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-04
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | WordPress Plugin WPGraphQL 0.2.3 - Multiple Vulnerabilities | 2019-05-21 |
| Nuclei | WPEngine WPGraphQL 0.2.3 - Unauthenticated Comment Posting |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-04 | facts | OSV |
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, Exploit-DB, GitHub Advisories, Nuclei, NVD, OSV |
References
wpvulndb.com/vulnerabilities/9282
packetstormsecurity.com/files/153025/WordPress-WPGraphQL-0.2.3-Authentication-Bypass-Information-Disclosure.html
pentestpartners.com/security-blog/pwning-wordpress-graphql
github.com/pentestpartners/snippets/blob/master/wp-graphql0.2.3_exploit.py
nvd.nist.gov/vuln/detail/CVE-2019-9881