PatchSiren cyber security CVE debrief

CVE-2026-54768 wp-graphql CVE debrief

The WPGraphQL plugin for WordPress, from version 2.0.0 to 2.15.1, contains a vulnerability in the deprecated user field on SendPasswordResetEmailPayload. This allows an unauthenticated caller to distinguish existing author-class accounts through the sendPasswordResetEmail mutation and obtain public profile fields. The issue is fixed in version 2.15.1. WPGraphQL users should review their configurations and ensure they are running version 2.15.1 or later to mitigate this vulnerability. Affected product deployments should be identified in managed environments, and owners should be assigned for follow-up. Official advisories and CVE records should be reviewed to validate affected scope, severity, and vendor guidance. Compensating controls for exposed systems should be considered while remediation is scheduled and verified. Monitoring, detection, and logs for exposed assets should be checked, and exceptions should be tracked. Remediated assets should be retested, and the item should only be closed after evidence is documented. The vulnerability has a medium severity and allows enumeration of existing author-class accounts via the sendPasswordResetEmail mutation. Defenders should verify WPGraphQL version, monitor for suspicious activity, and consider compensating controls for sensitive account data. Additional review of WPGraphQL configurations and integration with other security tools may be necessary.

Vendor: wp-graphql
Product: Unknown
CVSS: MEDIUM 6.9
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-07-31
Original CVE updated: 2026-07-31
Advisory published: 2026-07-31
Advisory updated: 2026-07-31

Who should care

WPGraphQL users, WordPress site administrators, security teams monitoring for potential enumeration attacks, and developers integrating WPGraphQL with other services should be aware of this vulnerability. They should review and apply WPGraphQL version 2.15.1 or later, monitor for suspicious sendPasswordResetEmail mutations, and consider compensating controls for sensitive account data. Additionally, they should inventory WPGraphQL installations and verify version numbers to ensure compliance with security policies.

Technical summary

Defensive priority

Medium-priority defensive review recommended due to potential for enumeration of existing author-class accounts.

Recommended defensive actions

Review and apply WPGraphQL version 2.15.1 or later
Monitor for suspicious sendPasswordResetEmail mutations
Inventory WPGraphQL installations and verify version
Consider compensating controls for sensitive account data
Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

Evidence from official CVE and NVD sources indicates a medium-severity vulnerability in WPGraphQL, allowing enumeration of existing author-class accounts via the sendPasswordResetEmail mutation. The issue is fixed in version 2.15.1. Defenders should verify WPGraphQL version, monitor for suspicious activity, and consider compensating controls for sensitive account data. Additional review of WPGraphQL configurations and integration with other security tools may be necessary.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-31T23:17:24.973Z and has not been modified since then.