[MEDIUM] WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)

PKSA-2dkq-4nxk-nkts CVE-2026-54768 GHSA-jhh7-832h-f8hv

Affected version: <=2.6.0

Reported by:
GitHub

[MEDIUM] WPGraphQL Plugin vulnerable to Server Side Request Forgery (SSRF)

PKSA-ns74-hkjj-48kh CVE-2023-23684 GHSA-cfh4-7wq9-6pgg

Affected version: <=1.14.5

Reported by:
GitHub