Detections
Analytics
CVE-2019-25060
medium
Description
The WPGraphQL WordPress plugin before 0.3.5 doesn't properly restrict access to information about other users' roles on the affected site. Because of this, a remote attacker could forge a GraphQL query to retrieve the account roles of every user on the site.
References
https://github.com/advisories/GHSA-w3xg-7q6m-3xwp
https://wpscan.com/vulnerability/393be73a-f8dc-462f-8670-f20ab89421fc