CVE Feed

Dashboard / CVE / CVE-2023-23684

CVE-2023-23684

Server-Side Request Forgery (SSRF) vulnerability in WPGraphQL.This issue affects WPGraphQL: from n/a through 1.14.5.

Published:Nov 13, 2023

Last Modified:Apr 28, 2026

EPS:Nov 13, 2023

EPSS Score:0.00158

CVSS Score:4.4

Affected Products

Vendor

Product

Action

Vendor

Wpengine

Product

Wpgraphql

Wpengine

Wpgraphql

Exploits

No exploit reference

Common Weakness Enumeration

CWE-918 Server-Side Request Forgery (SSRF)

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-664 Server Side Request Forgery

Related CVEs

CVE-2021-47959 (CVSS 8.7) — WordPress Plugin WPGraphQL 1.3.5 contains a denial of service vulnerability that allows unauthenticated attack…

CVE-2022-1563 (CVSS 5.3) — The WPGraphQL WooCommerce WordPress plugin before 0.12.4 does not prevent unauthenticated attackers from enume…

CVE-2019-9881 (CVSS 5.3) — The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post co…

CVE-2019-9880 (CVSS 9.1) — An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is …

CVE-2019-9879 (CVSS 9.8) — The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges,…

References

https://patchstack.com/database/vulnerability/wp-graphql/wordpress-wp-graphql-plugin-1-14-5-server-side-request-forgery-ssrf-vulnerability?_s_id=cve

https://patchstack.com/database/vulnerability/wp-graphql/wordpress-wp-graphql-plugin-1-14-5-server-side-request-forgery-ssrf-vulnerability?_s_id=cve

Common Vulnerability Scoring System

Attack Vector

Network

Adjacent

Local

Physical

Privileges Required

None

Low

High

User Interaction

None

Required

Scope

Unchanged

Changed

Confidentiality

None

Low

High

Integrity

None

Low

High

Availability

None

Low

High