Security readout for executives and security teams
Plain-English summary
Older WPGraphQL WordPress plugin versions could expose user role information to a remote attacker. This is an information disclosure issue, not proven site takeover. The business concern is reconnaissance: exposed roles can help attackers identify administrators or privileged accounts for targeted follow-on attacks.
Executive priority
Prioritize routine remediation for internet-facing WordPress properties using WPGraphQL. This is not sourced as actively exploited or critical, but it exposes user role intelligence that can support targeted attacks against privileged accounts.
Technical view
WPGraphQL before 0.3.5 improperly restricted access to other users' role information. A remote attacker could craft a GraphQL query to retrieve account roles for every user on the affected WordPress site. The cited CWE is CWE-284, Improper Access Control. No CVSS score is provided in the bundle.
Likely exposure
Exposure is limited to WordPress sites running the WPGraphQL plugin before 0.3.5, especially where the GraphQL endpoint is reachable by untrusted users. Sites without WPGraphQL, or running a non-affected version, are not indicated as affected by the provided sources.
Exploitation context
The source bundle describes remote retrieval of user roles through GraphQL. It does not cite public exploitation, exploit code, or CISA KEV listing. Treat exploitation status as unconfirmed, while recognizing the bug may aid account targeting and privilege-mapping.
Researcher notes
The evidence identifies an access-control failure around role disclosure, not authentication bypass or direct privilege escalation. Version data should be handled carefully: the title and description say versions before 0.3.5, while the affected field lists 0.3.5. Confirm against WPScan and upstream WPGraphQL records.
Mitigation direction
- Inventory WordPress sites for the WPGraphQL plugin and installed version.
- Upgrade affected WPGraphQL installations to 0.3.5 or later per vendor guidance.
- Review the referenced WPGraphQL pull request and WPScan advisory for fix context.
- Remove WPGraphQL from sites where it is not required.
- Check vendor guidance before applying compensating controls not named in the sources.
Validation and detection
- Confirm whether WPGraphQL is installed on each WordPress site.
- Verify the installed WPGraphQL version is not below 0.3.5.
- Review GraphQL exposure on public-facing WordPress sites.
- Check logs for unusual GraphQL queries requesting user role data.
- Confirm remediation by retesting role visibility as an unauthenticated or low-privilege user.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-284: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2019-25060 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://wpscan.com/vulnerability/393be73a-f8dc-462f-8670-f20ab89421fcCVE reference · x_refsource_MISC
- https://github.com/wp-graphql/wp-graphql/pull/900CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Access Control
Improper Access Control represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.