cve/2019/CVE-2019-25060.md

### [CVE-2019-25060](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25060)
![](https://img.shields.io/static/v1?label=Product&message=WPGraphQL&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=0.3.5%3C%200.3.5%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-284%20Improper%20Access%20Control&color=brighgreen)

### Description

The WPGraphQL WordPress plugin before 0.3.5 doesn't properly restrict access to information about other users' roles on the affected site. Because of this, a remote attacker could forge a GraphQL query to retrieve the account roles of every user on the site.

### POC

#### Reference
- https://wpscan.com/vulnerability/393be73a-f8dc-462f-8670-f20ab89421fc

#### Github
No PoCs found on GitHub currently.