CVE-2026-40762 HIGH

CVE-2026-40762: WordPress WPGraphQL plugin < 2.11.1 - SQL Injection vulnerability

Vendor Wpgraphql
Product WPGraphQL
Weakness CWE-89 · SQLi
Published June 15, 2026
Last update June 15, 2026
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:L

What the vulnerability does

01Description

Unauthenticated SQL Injection in WPGraphQL < 2.11.1 versions.

Explanation of Vulnerability in Simple Terms

02Summary

WPGraphQL versions before 2.11.1 contain a SQL injection vulnerability in query processing. An attacker can craft malicious GraphQL queries to extract sensitive data from the WordPress database without authentication. The vulnerability requires specific query conditions but can expose confidential information and degrade site performance.

What an attacker can do

03Attacker Capabilities

Extract sensitive data from the WordPress database via crafted GraphQL queries.

Potential impact on your site

04Site Impact

Unauthorized access to database contents including user data, posts, and configuration; potential site slowdown.

Conditions required to exploit

05Prerequisites

Network access to the GraphQL endpoint; no authentication or user interaction required.

Key dates

06Disclosure timeline

June 15, 2026 CVE published

Related vulnerabilities

08Related CVE

CVE-2026-57687 WordPress Custom Field Template plugin <= 2.7.8 - SQL Injection vulnerability CVE-2026-40798 WordPress wpForo Forum plugin <= 3.0.4 - SQL Injection vulnerability CVE-2026-49776 WordPress GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites plugin <= 2.32.6 - SQL Injection vulnerability CVE-2026-48886 WordPress JS Help Desk plugin <= 3.0.9 - SQL Injection vulnerability CVE-2026-12110 Taskbuilder <= 5.0.8 - Authenticated (Subscriber+) SQL Injection via 'task_search' Parameter