CVE-2019-25060

CVE-2019-25060 describes an information disclosure vulnerability in the WPGraphQL WordPress plugin prior to version 0.3.5. An unauthenticated remote attacker can exploit this flaw to retrieve the account roles of all users on a compromised site by crafting a specific GraphQL query. Rated Medium severity (CVSS 5.3), the attack requires no user interaction and has a low impact on confidentiality. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.