Exploitation Research Plan - CVE-2026-40762

1. Vulnerability Summary

The WPGraphQL plugin (versions < 2.11.1) contains an unauthenticated SQL injection vulnerability in its UserLoader class. The flaw exists because the plugin uses numbered placeholders (e.g., %1$s) within a $wpdb->prepare() call.

WordPress's $wpdb->prepare() implementation specifically looks for literal %s (string), %d (integer), or %f (float) placeholders to perform escaping and quoting. It does not recognize numbered placeholders like %1$s. Consequently, when the query is finally processed by vsprintf, the user-supplied input is interpolated directly into the SQL statement without being escaped or enclosed in quotes.

2. Attack Vector Analysis

• Endpoint: The standard GraphQL endpoint (default: /graphql or /?graphql=1).
• Authentication: Unauthenticated (by default).
• GraphQL Field: The nodes query or the users query's include argument.
• Vulnerable Parameter: The ids (within the nodes query) or include (within users(where: ...)).
• Payload Transport: The payload is carried inside a Base64-encoded string representing a GraphQL ID.

3. Code Flow

1. Entry Point: An unauthenticated user sends a GraphQL request to the endpoint.
2. Parsing: The WPGraphQL\Router processes the query. If the query is nodes(ids: [...]), it iterates through the provided IDs.
3. ID Decoding: WPGraphQL IDs are typically Base64 encoded strings in the format typename:id (e.g., user:1).
4. Loader Execution: For IDs with the type user, the WPGraphQL\Data\Loader\UserLoader is invoked via the loadKeys() method (line 120 of src/Data/Loader/UserLoader.php).
5. Vulnerable Sink: loadKeys() calls get_public_users( array $keys ) (line 144).
6. Query Construction:
   • $keys contains the raw IDs extracted from the Base64 input.
   • $ids = implode( ', ', $keys ) (line 90).
   • The query is built using $wpdb->prepare() on line 96:

     $wpdb->prepare(
         "SELECT DISTINCT $wpdb->users.ID FROM $wpdb->posts INNER JOIN $wpdb->users ON post_author = $wpdb->users.ID $where AND post_author IN ( %1\$s ) ORDER BY FIELD( $wpdb->users.ID, %2\$s)",
         $ids,
         $ids
     )
     

7. Injection: Because %1$s is used, $wpdb->prepare fails to escape $ids. vsprintf then performs raw interpolation.

4. Nonce Acquisition Strategy

By default, the WPGraphQL endpoint does not require a nonce for unauthenticated queries. If the setting "Restrict Endpoint to Authenticated Users" is enabled, the vulnerability is still present but requires a valid user session.

If the environment has been hardened to require a nonce for the GraphQL endpoint (uncommon but possible), it usually relies on the standard WordPress REST API nonce (wp_rest).

Strategy:

1. Check if the endpoint responds to a simple query without a nonce.
2. If a nonce is required, it is typically exposed via wp_localize_script under the key window.wpgraphql_settings?.nonce or similar.
3. Creation: Create a page with the [wpgraphql] shortcode (if available) or navigate to the admin dashboard (if authenticated).
4. Extraction: browser_eval("window.wpgraphql_settings?.nonce").

Note: In most default installations, no nonce is required for the payload below.

5. Exploitation Strategy

We will use a time-based blind SQL injection via the nodes query.

Step 1: Baseline Request

Confirm the endpoint is active and identify the Base64 ID format.

{
  "query": "query { users(first: 1) { nodes { id } } }"
}

If the ID returned is dXNlcjox (`user: