Unauthenticated SQL Injection in WPGraphQL by WordPress
CVE-2026-40762

7.5HIGH

Key Information:

Vendor

WordPress
Status
WPgraphql
Vendor
CVE Published:
15 June 2026

What is CVE-2026-40762?

An unauthenticated SQL injection vulnerability exists in WPGraphQL versions below 2.11.1, enabling attackers to manipulate database queries. This can lead to unauthorized access to sensitive data or disruptions in service. Proper measures must be adopted to ensure that instances of this plugin are updated to mitigate the risk associated with this vulnerability.

Affected Version(s)

WPGraphQL < 2.11.1

References

https://patchstack.com/database/wordpress/plugin/wp-graph...
vdb-entry

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

daroo | Patchstack Bug Bounty Program
.