CVE-2019-9880

An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username.

• CWE-306

• http://packetstormsecurity.com/files/153025/WordPress-WPGraphQL-0.2.3-Authentication-Bypass-Information-Disclosure.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/pentestpartners/snippets/blob/master/wp-graphql0.2.3_exploit.pyExploit, Third Party Advisory
• https://github.com/wp-graphql/wp-graphql/releases/tag/v0.3.0Release Notes, Third Party Advisory
• https://wpvulndb.com/vulnerabilities/9282Vendor Advisory
• https://www.pentestpartners.com/security-blog/pwning-wordpress-graphql/Exploit, Third Party Advisory
• http://packetstormsecurity.com/files/153025/WordPress-WPGraphQL-0.2.3-Authentication-Bypass-Information-Disclosure.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/pentestpartners/snippets/blob/master/wp-graphql0.2.3_exploit.pyExploit, Third Party Advisory
• https://github.com/wp-graphql/wp-graphql/releases/tag/v0.3.0Release Notes, Third Party Advisory
• https://wpvulndb.com/vulnerabilities/9282Vendor Advisory
• https://www.pentestpartners.com/security-blog/pwning-wordpress-graphql/Exploit, Third Party Advisory

Published

Jun 10, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-9873In several versions of JetBrains IntelliJ IDEA Ultimate, cre…
• CVE-2019-9874Deserialization of Untrusted Data in the Sitecore.Security.A…9.8
• CVE-2019-9875Deserialization of Untrusted Data in the anti CSRF module in…8.8
• CVE-2019-9877There is an invalid memory access vulnerability in the funct…
• CVE-2019-9878There is an invalid memory access in the function GfxIndexed…
• CVE-2019-9879The WPGraphQL 0.2.3 plugin for WordPress allows remote attac…
• CVE-2019-9881The createComment mutation in the WPGraphQL 0.2.3 plugin for…
• CVE-2019-9882Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF…
• CVE-2019-9883Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF…
• CVE-2019-9884eClass platform < ip.2.5.10.2.1 allows an attacker to use GE…9.8
• CVE-2019-9885eClass platform < ip.2.5.10.2.1 allows an attacker to execut…9.8
• CVE-2019-9886Any URLs with download_attachment.php under templates or hom…7.5