[MEDIUM] WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)

PKSA-2dkq-4nxk-nkts CVE-2026-54768 GHSA-jhh7-832h-f8hv

Affected package: wp-graphql/wp-graphql

Affected version: <=2.6.0

Reported by:
GitHub