{"id":"CVE-2019-9880","aliases":["EUVD-2019-19236","GHSA-hmw5-56mv-q94w"],"status":"published","title":"An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users'...","description":"An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username.","severity":{"version":"3.0","score":9.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.34835,"percentile":0.98441,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-306"],"published":"2019-06-10T17:32:39Z","modified":"2026-11-04T02:45:35Z","exploits":[{"source":"exploitdb","id":"EDB-46886","title":"WordPress Plugin WPGraphQL 0.2.3 - Multiple Vulnerabilities","type":"webapps","platform":"php","date":"2019-05-21","url":"https://www.exploit-db.com/exploits/46886"},{"source":"nuclei","id":"CVE-2019-9880","title":"WPEngine WPGraphQL 0.2.3 - Unauthenticated User Information Disclosure","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9880.yaml"}],"products":[{"vendor":"wpengine","product":"wpgraphql"}],"references":[{"url":"https://wpvulndb.com/vulnerabilities/9282","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory"]},{"url":"http://packetstormsecurity.com/files/153025/WordPress-WPGraphQL-0.2.3-Authentication-Bypass-Information-Disclosure.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://www.pentestpartners.com/security-blog/pwning-wordpress-graphql/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://github.com/pentestpartners/snippets/blob/master/wp-graphql0.2.3_exploit.py","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://github.com/wp-graphql/wp-graphql/releases/tag/v0.3.0","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9880"},{"url":"https://github.com/advisories/GHSA-hmw5-56mv-q94w"}],"sources":{"cve":[{"id":"CVE-2019-9880","description":"An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username.","status":"published","published":"2019-06-10T17:32:39Z","modified":"2024-11-15T15:18:44.814Z","updated_at":"2026-11-02T14:20:20.081405Z"}],"euvd":[{"id":"EUVD-2019-19236","description":"An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username.","status":"published","published":"2019-06-10T17:32:39Z","modified":"2024-11-15T15:18:44Z","updated_at":"2026-11-03T00:04:59.953537Z"}],"ghsa":[{"id":"GHSA-hmw5-56mv-q94w","title":"An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users'...","description":"An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username.","status":"published","published":"2022-05-24T16:47:42Z","modified":"2024-01-22T18:31:15Z","cvss":[{"version":"3.0","score":9.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:55:27.854531Z"}],"nvd":[{"id":"CVE-2019-9880","description":"An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username.","status":"published","published":"2019-06-10T18:29:01.143Z","modified":"2026-06-17T02:44:46.803Z","cvss":[{"version":"3.0","score":9.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"primary"},{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:05:16.285679Z"}],"osv":[{"id":"CVE-2019-9880","description":"An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username.","status":"published","published":"2019-06-10T18:29:01.143Z","modified":"2026-11-10T02:30:41.812690168Z","cvss":[{"version":"3.0","score":9.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-10T02:45:46.628596Z"}]}}