CVE-2026-54768: 
PHP vulnerability analysis and mitigation

CVE-2026-54768 is a user enumeration and profile disclosure vulnerability in the WPGraphQL WordPress plugin affecting versions 2.0.0 through 2.14.1 (prior to 2.15.1). A deprecated user field on the SendPasswordResetEmailPayload GraphQL type allows unauthenticated callers to determine whether a given username or email belongs to a registered author-class account, and to retrieve their public profile fields — directly undermining the plugin's explicit anti-enumeration design. The vulnerability was discovered via source code review on May 29, 2026, and publicly disclosed on June 9, 2026, with the advisory published to the GitHub Advisory Database on July 31, 2026. It carries a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory).

The root cause is an Observable Response Discrepancy (CWE-204): the sendPasswordResetEmail mutation resolver in src/Mutation/SendPasswordResetEmail.php is intentionally designed to always return success: true to prevent user enumeration, but it internally populates $payload['id'] with the real user ID when the account exists. A deprecated user field registered in src/Deprecated.php reads this internal $payload['id'] and resolves it through the standard user loader, returning a full User object for existing author-class accounts and null for non-existent ones — creating a binary oracle. The WPGraphQL User Model's allowed_restricted_fields policy permits unauthenticated reads of public author fields (databaseId, name, firstName, lastName, slug, description, uri, url), making the leak exploitable with a single unauthenticated GraphQL mutation. A proof-of-concept mutation was included in the advisory itself (GitHub Advisory).

An unauthenticated attacker can confirm whether any username or email address is registered on the WordPress site, and for author-class users (those with published posts, including editors and administrators), retrieve databaseId, name, firstName, lastName, slug, description (bio), and uri. This bypasses partial hardening measures such as disabled REST API user endpoints, suppressed author XML sitemaps, and blocked ?author=N redirects. The harvested profile data can directly facilitate targeted spearphishing campaigns, credential stuffing, or further account-targeted attacks (GitHub Advisory).

1. Identify target: Locate a WordPress site running WPGraphQL version 2.0.0–2.14.1 (e.g., by checking the /graphql endpoint or plugin headers).
2. Confirm GraphQL endpoint: Send a simple introspection query to https://target.example.com/graphql to verify the endpoint is active and the sendPasswordResetEmail mutation is available.
3. Craft enumeration mutation: Construct the following GraphQL mutation with a candidate username or email:

query EnumerateUser {
  sendPasswordResetEmail(input: { username: "victim@example.com" }) {
    success
    user {
      databaseId
      name
      firstName
      lastName
      slug
      description
      uri
    }
  }
}

4. Interpret response: If data.sendPasswordResetEmail.user is null, the account does not exist. If it returns a populated User object, the account exists and profile data is disclosed.
5. Iterate at scale: Automate the mutation with a list of target email addresses or usernames to enumerate registered accounts. No authentication or rate limiting is enforced by WPGraphQL.
6. Leverage harvested data: Use disclosed firstName, lastName, description, and email (if inferred) to craft targeted spearphishing emails or attempt credential stuffing against other services (GitHub Advisory).

• Network: High volume of POST requests to the /graphql endpoint from a single IP or rotating IPs, each containing the sendPasswordResetEmail mutation with varying username input values.
• Logs: Web server or application logs showing repeated GraphQL POST requests with bodies referencing sendPasswordResetEmail and the user field; requests originating from automated tools (e.g., missing browser-typical headers, sequential timing).
• Application: GraphQL query logs (if enabled) showing the deprecated user field being requested on SendPasswordResetEmailPayload — legitimate clients should not be querying a deprecated field in production.
• Behavioral: Enumeration patterns where the same endpoint is queried with many different email addresses or usernames in rapid succession, particularly targeting known author slugs or common email formats.

Upgrade WPGraphQL to version 2.15.1 or later, which gates the deprecated user field on the list_users capability so it returns null for unauthenticated callers regardless of account existence (WPGraphQL Release). If immediate upgrade is not possible, a temporary workaround is to add a custom filter or plugin snippet that overrides the SendPasswordResetEmailPayload.user resolver to always return null. Additionally, implementing a web application firewall (WAF) rule to rate-limit or block automated GraphQL mutation requests to the sendPasswordResetEmail endpoint can reduce enumeration risk while patching is pending (GitHub Advisory).

The vulnerability was reported by independent security researcher Luke Granto (lukegranto23), who discovered it via source code review in approximately 15 minutes and reported it in good faith with no live exploitation against third-party deployments. The WPGraphQL maintainer (jasonbahl) published the advisory and released the patch on June 9, 2026. No significant broader media coverage or notable community commentary beyond the advisory itself has been identified at this time (GitHub Advisory).