CVE-2019-9879

Public exploit available. Not confirmed exploited in the wild yet. A vendor fix is available.

CVSS 3.09.8Critical EPSS percentile99th47% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 2 sources FixVendor fixNo build named by the sources

Published 2019-06-10Updated 2024-11-21Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check your WordPress plugins list for WPGraphQL version 0.2.3 (or earlier) and confirm whether public user registration is enabled in your site settings.
If registration is open, disable it immediately as a stop-gap while you update.
Update WPGraphQL to the latest patched version available from the WordPress plugin repository.
Review your list of WordPress admin users for any accounts you don't recognize and remove them.
Ask your web developer or host to confirm the plugin is updated and no rogue admin accounts exist.

Vendor advisory Some work to apply

Check it yourselfA free Nuclei check exists for this CVE. Run it against your hosts.Is your organisation exposed?Discuss checks for your systems with a specialist. Scope is agreed before testing.

What it is

From the CVE record

The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever new user registrations are allowed. This is related to the registerUser mutation.

In plain language

Written by AI from the record

A flaw in the WPGraphQL plugin for WordPress let anyone sign up as a full admin on your site if you allowed public user registration — this is a serious, actively discussed threat and you should check it now.

Improper authorization (CWE-306) in WPGraphQL 0.2.3's registerUser GraphQL mutation allows unauthenticated attackers to create a new account with administrator privileges whenever self-registration is enabled, with public PoC exploit code available.

If you're affected

Full site takeover
Admin account creation by anyone
Content and data manipulation
Site used for malware/spam
Customer trust damage

What is it

Think of your website's 'sign up' form as normally handing out basic customer accounts, like a store membership card. This bug let anyone who filled out that form hand themselves the store manager's keys instead — full control of your website — without anyone approving it.

Who is affected

This matters to you if your WordPress site runs the WPGraphQL plugin. The risk is only live if your site has public new-user registration turned on — if registration is closed, this specific path to admin access isn't usable.

How urgent is it

This is a red-alert issue: there is sustained public and security-press attention tied to active exploitation of this flaw, plus working exploit code is publicly available on GitHub. Any site with WPGraphQL and open registration should be treated as at immediate risk of a full admin takeover.

What to do — in detail

Confirm exposure by checking the installed WPGraphQL version (0.2.3 is confirmed vulnerable) and verifying whether WordPress user registration is enabled (Settings > General > Membership). As an immediate workaround if you cannot patch right away, disable open registration and audit the wp_users table / admin dashboard for unexpected administrator accounts, removing any unrecognized ones. Upgrade WPGraphQL to the current release from the official WordPress.org plugin repository, which removes the unauthenticated privilege-escalation path in the registerUser mutation; there are no known breaking-change concerns tied specifically to this security fix. After patching, monitor GraphQL endpoint logs and user-creation events for further registerUser mutation attempts, since public PoC exploit code is in circulation and this CVE is not yet in CISA's KEV catalog but has sustained press attention tied to real-world exploitation.

Technical context

CVSS 9.8 (Critical), AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — unauthenticated, network-exploitable, no user interaction, full compromise of confidentiality, integrity and availability. Weakness: CWE-306 (Missing Authentication for Critical Function) in the registerUser GraphQL mutation, which fails to restrict the role assigned during self-registration. Exploit maturity: two public PoCs on GitHub; not currently listed in CISA KEV, but sustained press attention attributes active exploitation to this flaw, which per findings-precedence supersedes the EPSS prediction for urgency purposes.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

2 sources with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

47% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

Sustained, driven by in-the-wild reports.

Lifecycle

The patch came 471 days before any public exploit.

2026-06-22EPSS band changehigh → moderate
2026-03-06Public exploit / PoCsource: github-pocnuclei check added
2024-11-21Patch availablerecord updated
2019-06-10Publishedweakness classified, att&ck mapped

Affected products

wpenginecommercial
- wpgraphqlSaaSCloud & SaaS / cloud-platform

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable