CVE-2026-54768

Description

WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts through the sendPasswordResetEmail mutation and obtain public profile fields. This issue is fixed in version 2.15.1.

References

• https://github.com/wp-graphql/wp-graphql/releases/tag/wp-graphql/v2.15.1
• https://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-jhh7-832h-f8hv