CVE-2025-68604
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
A Cross-Site Request Forgery (CSRF) vulnerability in WPGraphQL allows attackers to perform unauthorized actions. This issue affects WPGraphQL from n/a through 2.5.3.
Risk Assessment
Unauthorized changes to the WordPress site, including data or configuration modifications, may occur, threatening system integrity.
Recommendation
Update the WPGraphQL plugin to a version later than 2.5.3.
Other vulnerabilities in WPGraphQL
See all- CVE-2026-109703Medium
The WPGraphQL plugin for WordPress has a missing authorization vulnerability that allows retrieving embedded sensitive data. This affects all versions from n/a through 2.23.1.
- CVE-2026-88974Medium
The WPGraphQL plugin for WordPress prior to 2.22.2 does not enforce object-level capabilities in the updatePost mutation. An authenticated Contributor can publish their own drafts without editorial approval or modify their own previously published posts despite lacking edit_published_posts.
- CVE-2026-54768Medium
In WPGraphQL for WordPress versions 2.0.0 to 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts and obtain public profile fields.
- CVE-2026-40762High
WPGraphQL versions below 2.11.1 are vulnerable to unauthenticated SQL Injection.
Original NVD description (English source)
Cross-Site Request Forgery (CSRF) vulnerability in WPGraphQL allows Cross Site Request Forgery. This issue affects WPGraphQL: from n/a through 2.5.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS