CVE-2019-9881

The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled.

CVSS v3.0 NVD

5.3 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CVSS v2.0 NVD

5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N

EPSS

18.83% chance of exploitation in the next 30 days, 97th percentile

Nuclei

medium · CWE-306

Published

2019-06-10

Updated

2024-08-04

Proof-of-concept exploits (2)

• http://packetstormsecurity.com/files/153025/WordPress-WPGraphQL-0.2.3-Authentication-Bypa…
• https://www.pentestpartners.com/security-blog/pwning-wordpress-graphql/

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9881.yaml

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/46886

Security advisories

• pentestpartners/snippets/blob/master/wp-graphql0.2.3_exploit.py
• wp-graphql/wp-graphql/releases/tag/v0.3.0
• https://wpvulndb.com/vulnerabilities/9282
• https://www.pentestpartners.com/security-blog/pwning-wordpress-graphql

References

• CVE Record
• NVD entry