CVE-2026-54768
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Jul 31, 2026
Vendor
unknown
Description
WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts through the sendPasswordResetEmail mutation and obtain public profile fields. This issue is fixed in version 2.15.1.