CVE-2019-9880: Wpengine Wpgraphql

Critical severity, CVSS 9.1. EPSS: 35.6% chance of exploitation in the next 30 days.

An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username.

Affected products

• Wpengine Wpgraphql: version 0.2.3 only

Published 2019-06-10. Last modified 2026-06-17.