WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-cl…
提示
摘要
WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts through the sendPasswordResetEmail mutation and obtain public profile fields. This issue is fixed in version 2.15.1.
中文摘要建设中,暂以英文摘要呈现(DR-003 v2)。
深度研判 · 自动通道
该漏洞尚未生成深度研判报告(DR-003 v2 AI pipeline 建设中)。
数据来源
- NVD DATABASE
原始链接
- https://github.com/wp-graphql/wp-graphql/releases/tag/wp-graphql/v2.15.1
- https://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-jhh7-832h-f8hv
- https://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-jhh7-832h-f8hv
时间线
- nvd_ingest NVD