CVE-2019-9881

medium

Description

The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled.

References

Advisories
More

https://wpvulndb.com/vulnerabilities/9282

https://github.com/wp-graphql/wp-graphql/releases/tag/v0.3.0

https://www.pentestpartners.com/security-blog/pwning-wordpress-graphql/

https://github.com/pentestpartners/snippets/blob/master/wp-graphql0.2.3_exploit.py

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-19237

http://packetstormsecurity.com/files/153025/WordPress-WPGraphQL-0.2.3-Authentication-Bypass-Information-Disclosure.html

Details

Source: Mitre, NVD

Published: 2019-06-10

Updated: 2026-06-17

Risk Information

CVSS v2

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 5.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N