CVE-2019-9879

Critical9.8 Published on Jun 10, 2019

The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever new user registrations are allowed. This is related to the registerUser mutation.

CVSS score9.8 / 10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness type (CWE)CWE-306

Vendorswpengine

Affected products

Vendors	Product	Versions
wpengine	wpgraphql	0.2.3

Vulnerabilities

Bricksforge WordPress flaw CVE-2026-85097 is under attack, letting anonymous visitors run PHP

Attackers exploit Bricksforge flaw to upload files as PHP without login, risking site takeover. Update advised and check uploads for abuse.

Oct 12, 202611:01 5 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

CVE-2019-9879

Affected products

Related articles

Bricksforge WordPress flaw CVE-2026-85097 is under attack, letting anonymous visitors run PHP

Audience measurement