Search/CVE-2026-54768
● CVE

CVE-2026-54768

DiscoveredJul 31, 2026UpdatedSep 10, 2026

WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts through the sendPasswordResetEmail mutation and obtain public profile fields. This issue is fixed in version 2.15.1.

View graph Watch Export
CVSS v3.1
—
EPSS
0.45%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
0
sources referencing this CVE
Related IOCs
0
seen in the same coverage
EPSS Trend
Sep 12, 2026 → Sep 25, 2026
▲ 0.10pp
0.34% → 0.45% over 2 tracked changes
Connections
1 relationships
Timeline
disclosure → media coverage
Jul 31, 2026
Disclosure — published as a CVE record. · last revised by NVD Sep 10, 2026