CVE-2026-54768 wp-graphql CVE debrief

Who should care

WPGraphQL users, WordPress site administrators, security teams monitoring for potential enumeration attacks, and developers integrating WPGraphQL with other services should be aware of this vulnerability. They should review and apply WPGraphQL version 2.15.1 or later, monitor for suspicious sendPasswordResetEmail mutations, and consider compensating controls for sensitive account data. Additionally, they should inventory WPGraphQL installations and verify version numbers to ensure compliance with security policies.

Technical summary

The WPGraphQL plugin for WordPress, from version 2.0.0 to 2.15.1, contains a vulnerability in the deprecated user field on SendPasswordResetEmailPayload. This allows an unauthenticated caller to distinguish existing author-class accounts through the sendPasswordResetEmail mutation and obtain public profile fields. The issue is fixed in version 2.15.1. WPGraphQL users should review their configurations and ensure they are running version 2.15.1 or later to mitigate this vulnerability.

Defensive priority

Medium-priority defensive review recommended due to potential for enumeration of existing author-class accounts.

Recommended defensive actions

• Review and apply WPGraphQL version 2.15.1 or later
• Monitor for suspicious sendPasswordResetEmail mutations
• Inventory WPGraphQL installations and verify version
• Consider compensating controls for sensitive account data
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

Evidence from official CVE and NVD sources indicates a medium-severity vulnerability in WPGraphQL, allowing enumeration of existing author-class accounts via the sendPasswordResetEmail mutation. The issue is fixed in version 2.15.1. Defenders should verify WPGraphQL version, monitor for suspicious activity, and consider compensating controls for sensitive account data. Additional review of WPGraphQL configurations and integration with other security tools may be necessary.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.