medium6.9
CVE-2026-54768
WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)
Impact
WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts through the sendPasswordResetEmail mutation and obtain public profile fields. This issue is fixed in version 2.15.1.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | wp-graphql/wp-graphql | <= 2.6.0 | none recorded |