CVE-2026-40762: WordPress WPGraphQL plugin < 2.11.1 - SQL Injection vulnerability

Synopsis

An unauthenticated SQL injection vulnerability affects the WPGraphQL WordPress plugin in all versions before 2.11.1. The flaw is reachable over the network without any credentials, though exploitation requires overcoming high-complexity conditions such as specific timing or environmental factors. A successful attacker can read sensitive data from the underlying database and cause limited disruption to service availability. A patched-image rebuild at version 2.11.1 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WPGraphQL endpoint over the network; no local or physical access is required.

• AuthenticationNot required

  No credentials or account of any kind are needed to trigger the injection.

• Victim interactionNot required

  The attacker acts entirely on their own without needing any action from a legitimate user.

• Attack complexityDetail

  Exploitation is rated high complexity, meaning the attacker must account for race conditions, specific environmental states, or other factors outside their direct control before the attack reliably succeeds.

Blast Radius

• A successful attacker reads arbitrary rows from the WordPress database, including stored user credentials, session tokens, and site configuration data.
• Database contents scoped to the application user are exposed; cross-site scope change (S:C) means impact can extend beyond the immediate WordPress installation context.
• Service availability is partially degraded, as the malformed queries can disrupt database responsiveness for legitimate requests.