wp-graphql vulnerabilities

WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost

wp-graphql · wp-graphql

WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)

wp-graphql · wp-graphql

WPGraphQL Repo's updateComment allows low-privileged authenticated users to change comment moderation status (comment_approved) without moderate_comments permission

wp-graphql · wp-graphql

WPGraphQL Repo Vulnerable to Command Injection via Unsanitized GitHub Actions Expression in Release Workflow

wp-graphql · wp-graphql