{"vulnerability": "CVE-2026-54768", "sightings": [{"uuid": "96e8afea-71f9-4e3c-b1b5-305a938fde14", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-54768", "type": "published-proof-of-concept", "source": "https://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-jhh7-832h-f8hv", "content": "", "creation_timestamp": "2026-08-01T00:35:06.259371Z"}, {"uuid": "8f362fcb-38f3-4d0b-9469-51721536bc02", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54768", "type": "seen", "source": "https://gist.github.com/alon710/662b2c487ba3f86d2983484c0e6fc728", "content": "# CVE-2026-54768: CVE-2026-54768: User Enumeration and Profile Leak in WPGraphQL via Deprecated Field Resolver\n\n> **CVSS Score:** 6.9\n> **Published:** 2026-07-31\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54768\n\n## Summary\nAn observable response discrepancy vulnerability in WPGraphQL versions 2.0.0 through 2.15.0 allows unauthenticated remote attackers to enumerate users and extract public profile metadata. Although the password reset mutation is designed to return a uniform success response to prevent enumeration, a legacy deprecated field resolver bypasses this mechanism by resolving the associated user profile if the target account exists.\n\n## TL;DR\nA deprecated field resolver in WPGraphQL's password reset mutation leaks user existence and profile metadata, undermining anti-enumeration controls.\n\n## Technical Details\n\n- **CWE ID**: CWE-204\n- **Attack Vector**: Network\n- **CVSS v4.0**: 6.9 (Medium)\n- **Exploit Status**: Proof of Concept Available\n- **CISA KEV Status**: Not Listed\n- **Ransomware Association**: No Known Use\n- **Impact**: Unauthenticated Username Enumeration and Metadata Disclosure\n\n## Affected Systems\n\n- WPGraphQL (WordPress Plugin) versions 2.0.0 through 2.15.0\n- **WPGraphQL**: >= 2.0.0, < 2.15.1 (Fixed in: `2.15.1`)\n\n## Mitigation\n\n- Upgrade the WPGraphQL plugin to the non-vulnerable version 2.15.1 or later.\n- Apply a manual code hotfix to prevent the deprecated resolver from processing the internal ID field.\n- Implement WAF rules to block incoming queries matching the enumeration mutation signature.\n\n**Remediation Steps:**\n1. Locate the active installation of WPGraphQL on your WordPress server.\n2. Perform a clean update to version 2.15.1 using the WordPress Admin interface, WP-CLI, or Composer.\n3. If manual hotfixing is necessary, open 'src/Deprecated.php' and locate the 'SendPasswordResetEmailPayload' configuration.\n4. Modify the 'resolve' callback on the 'user' field definition to return null unconditionally.\n5. Open 'src/Mutation/SendPasswordResetEmail.php' and set the returned 'id' field to null in the success payload return array.\n6. Deploy WAF rule pattern 'mutation.*sendPasswordResetEmail.*user\\s*\\{' to reject unauthorized enumeration requests.\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54768) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-01T01:31:13.245707Z"}]}