CVE-2022-1563: Wpengine Wpgraphql

Medium severity, CVSS 5.3. EPSS: 0.7% chance of exploitation in the next 30 days.

The WPGraphQL WooCommerce WordPress plugin before 0.12.4 does not prevent unauthenticated attackers from enumerating a shop's coupon codes and values via GraphQL.

Affected products

• Wpengine Wpgraphql: up to and including 0.12.3

Published 2024-01-16. Last modified 2026-06-17.