https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 09:44:01 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-343971 EUVD-2026-343971 https://cve.radiocsirt.org/vuln/euvd-2026-343971 https://cve.radiocsirt.org/vuln/fkie_cve-2026-54768 <p>WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts through the sendPasswordResetEmail mutation and obtain public profile fields. This issue is fixed in version 2.15.1.</p> <p>WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts through the sendPasswordResetEmail mutation and obtain public profile fields. This issue is fixed in version 2.15.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-54768 https://cve.radiocsirt.org/vuln/ghsa-jhh7-832h-f8hv <p><strong>Affected:</strong> Packagist: wp-graphql/wp-graphql</p> <p>## Summary</p> <p>The `sendPasswordResetEmail` mutation in WPGraphQL is explicitly designed to prevent user enumeration. The resolver in `src/Mutation/SendPasswordResetEmail.php` states in a code comment:</p> <p>`// We obsfucate the actual success of this mutation to prevent user enumeration.`</p> <p>The mutation always returns `success: true` regardless of whether the supplied username/email belongs to an existing user. The intended public output field is only `success: Boolean`.</p> <p>However, a deprecated `user` field is still registered on the `SendPasswordResetEmailPayload` output type in `src/Deprecated.php` (lines 433-450). This deprecated field resolves to a full `User` object when the supplied username/email corresponds to an existing author-class user, and `null` otherwise — completely undermining the anti-enumeration design.</p> <p>The `@todo remove in 3.0.0` comment acknowledges the field is scheduled for removal, but it remains active in all 2.x releases, including current 2.14.1.</p> <p>Discovered via source code review on May 29, 2026.</p> <p>## Details</p> <p>The mutation resolver in `src/Mutation/SendPasswordResetEmail.php`:</p> <p>```php $payload = [&#39;success&#39; =&gt; true, &#39;id&#39; =&gt; null]; $user_data = self::get_user_data($input[&#39;username&#39;]); if (!$user_data) { graphql_debug(...); return $payload; // id stays null } // ...send email, then... return [&#39;id&#39; =&gt; $user_data-&gt;ID, &#39;success&#39; =&gt; true]; ```</p> <p>The intended public output field is only `success`. The `id` is internal-only state for downstream resolvers.…</p> <p><strong>Affected:</strong> Packagist: wp-graphql/wp-graphql</p> <p>## Summary</p> <p>The `sendPasswordResetEmail` mutation in WPGraphQL is explicitly designed to prevent user enumeration. The resolver in `src/Mutation/SendPasswordResetEmail.php` states in a code comment:</p> <p>`// We obsfucate the actual success of this mutation to prevent user enumeration.`</p> <p>The mutation always returns `success: true` regardless of whether the supplied username/email belongs to an existing user. The intended public output field is only `success: Boolean`.</p> <p>However, a deprecated `user` field is still registered on the `SendPasswordResetEmailPayload` output type in `src/Deprecated.php` (lines 433-450). This deprecated field resolves to a full `User` object when the supplied username/email corresponds to an existing author-class user, and `null` otherwise — completely undermining the anti-enumeration design.</p> <p>The `@todo remove in 3.0.0` comment acknowledges the field is scheduled for removal, but it remains active in all 2.x releases, including current 2.14.1.</p> <p>Discovered via source code review on May 29, 2026.</p> <p>## Details</p> <p>The mutation resolver in `src/Mutation/SendPasswordResetEmail.php`:</p> <p>```php $payload = [&#39;success&#39; =&gt; true, &#39;id&#39; =&gt; null]; $user_data = self::get_user_data($input[&#39;username&#39;]); if (!$user_data) { graphql_debug(...); return $payload; // id stays null } // ...send email, then... return [&#39;id&#39; =&gt; $user_data-&gt;ID, &#39;success&#39; =&gt; true]; ```</p> <p>The intended public output field is only `success`. The `id` is internal-only state for downstream resolvers.…</p> https://cve.radiocsirt.org/vuln/ghsa-jhh7-832h-f8hv