CVE-2026-40762
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
WPGraphQL versions below 2.11.1 are vulnerable to unauthenticated SQL Injection.
Risk Assessment
An attacker could exploit this vulnerability to gain access to sensitive data in the database, potentially leading to serious security breaches.
Recommendation
It is recommended to update WPGraphQL to version 2.11.1 or later to mitigate this vulnerability.
Other vulnerabilities in WPGraphQL
See all- CVE-2026-109703Medium
The WPGraphQL plugin for WordPress has a missing authorization vulnerability that allows retrieving embedded sensitive data. This affects all versions from n/a through 2.23.1.
- CVE-2026-88974Medium
The WPGraphQL plugin for WordPress prior to 2.22.2 does not enforce object-level capabilities in the updatePost mutation. An authenticated Contributor can publish their own drafts without editorial approval or modify their own previously published posts despite lacking edit_published_posts.
- CVE-2026-54768Medium
In WPGraphQL for WordPress versions 2.0.0 to 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts and obtain public profile fields.
- CVE-2025-68604Medium
A Cross-Site Request Forgery (CSRF) vulnerability in WPGraphQL allows attackers to perform unauthorized actions. This issue affects WPGraphQL from n/a through 2.5.3.
Original NVD description (English source)
Unauthenticated SQL Injection in WPGraphQL < 2.11.1 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS