CVE-2019-9879: WPGraphQL plugin missing authentication in registerUser mutation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityUnauthenticated remote creation of an administrator account gives complete site compromise, and public exploit code exists, though KEV does not list it.

What it is

The WPGraphQL 0.2.3 plugin for WordPress exposes a registerUser GraphQL mutation that lacks proper authorization checks, letting a remote attacker create a new account with administrator privileges whenever user registration is enabled. Because the resulting account is an admin, this is effectively a full site takeover path on affected installs.

Impact

An unauthenticated attacker gains a WordPress administrator account, which allows full control of the site, including content, plugins, themes and potentially the underlying host depending on configuration.

Attack surface

Reached remotely over the network through the plugin's GraphQL endpoint by invoking the registerUser mutation; no authentication is required and no user interaction is needed, though the site must permit new user registrations.

Exploitation

Public exploit code and a detailed write-up are referenced, and EPSS is high (about 0.47, 98.8th percentile), but the CVE is not listed in CISA KEV, so no confirmed in-the-wild exploitation is documented in this record.

What to do

• Upgrade WPGraphQL to version 0.3.0 or later, which the release notes indicate addresses this issue.
• If immediate upgrade is not possible, disable open user registration and restrict or disable the GraphQL endpoint.
• Audit existing WordPress users for unexpected administrator accounts and remove any that are not authorized.
• Rotate credentials and review logs for suspicious account creation or admin activity.
• Apply least-privilege and hardening controls to limit the blast radius of any compromised admin account.

Detection

• Monitor WordPress and web server logs for POST requests to the GraphQL endpoint containing the registerUser mutation.
• Alert on creation of new administrator accounts, especially from unexpected source IPs or outside change windows.
• Review WPGraphQL plugin version across all WordPress instances and flag any still on 0.2.3 or earlier.
• Correlate new admin account creation with subsequent login and configuration changes for signs of takeover.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.