EUVD-2026-294184

fkie_cve-2023-23684

Server-Side Request Forgery (SSRF) vulnerability in WPGraphQL.This issue affects WPGraphQL: from n/a through 1.14.5.

GHSA-cfh4-7wq9-6pgg — WPGraphQL Plugin vulnerable to Server Side Request Forgery (SSRF)

Affected: Packagist: wp-graphql/wp-graphql

### Impact Users with capabilities to upload media (editors and above) are succeptible to SSRF (Server-Side Request Forgery) when executing the `createMediaItem` Mutation.

Authenticated users making GraphQL requests that execute the `createMediaItem` could pass executable paths in the mutations `filePath` argument that could give them unwarranted access to the server.

It's recommended to update to WPGraphQL v1.14.6 or newer. If you're unable to do so, below is a snippet you can add to your functions.php (or similar) that filters the `createMediaItem` mutation's resolver.

### Patches

- [v1.14.6](https://github.com/wp-graphql/wp-graphql/releases/tag/v1.14.6) - https://github.com/wp-graphql/wp-graphql/pull/2840

### Workarounds If you're unable to upgrade to v1.14.6 or higher, you should be able to use the following snippet in your functions.php to override the vulnerable resolver.

This snippet has been tested as far back as WPGraphQL v0.15

```php add_filter( 'graphql_pre_resolve_field', function( $nil, $source, $args, $context, \GraphQL\Type\Definition\ResolveInfo $info, $type_name, $field_key, $field, $field_resolver ) {

if ( $info->fieldName !== 'createMediaItem' ) { return $nil; }

$input = $args['input'] ?? null;

if ( ! isset( $input['filePath'] ) ) { return $nil; }

$uploaded_file_url = $input['filePath'];

// Check that the filetype is allowed $check_file = wp_check_filetype( $uploaded_file_url );

// if the file doesn't pass the check,…

Most recent entries from all

EUVD-2026-294184

fkie_cve-2023-23684

GHSA-cfh4-7wq9-6pgg — WPGraphQL Plugin vulnerable to Server Side Request Forgery (SSRF)

gsd-2023-23684