CVE-2019-9881

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

18.83%

Published

Jun 10, 2019

Modified

Nov 21, 2024

Public PoC / Exploit (3)

All weaponized →

Exploit-DBWordPress Plugin WPGraphQL 0.2.3 - Multiple Vulnerabilities TrickestTrickest PoC index NucleiNuclei detection template

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled.

Weaknesses (CWE)

CWE-306

Affected Products (1)

wpengine · wpgraphqlvulnerable

References (10)

http://packetstormsecurity.com/files/153025/WordPress-WPGraphQL-0.2.3-Authentication-Bypass-Information-Disclosure.html

ExploitThird Party AdvisoryVDB Entry

https://github.com/pentestpartners/snippets/blob/master/wp-graphql0.2.3_exploit.py

ExploitThird Party Advisory

https://github.com/wp-graphql/wp-graphql/releases/tag/v0.3.0

Release NotesThird Party Advisory

https://wpvulndb.com/vulnerabilities/9282

Release NotesThird Party Advisory

https://www.pentestpartners.com/security-blog/pwning-wordpress-graphql/

ExploitThird Party Advisory

http://packetstormsecurity.com/files/153025/WordPress-WPGraphQL-0.2.3-Authentication-Bypass-Information-Disclosure.html

ExploitThird Party AdvisoryVDB Entry

https://github.com/pentestpartners/snippets/blob/master/wp-graphql0.2.3_exploit.py

ExploitThird Party Advisory

https://github.com/wp-graphql/wp-graphql/releases/tag/v0.3.0

Release NotesThird Party Advisory

https://wpvulndb.com/vulnerabilities/9282

Release NotesThird Party Advisory

https://www.pentestpartners.com/security-blog/pwning-wordpress-graphql/

ExploitThird Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs