Gato GraphQL <= 19.2.3 - Authenticated (Subscriber+) Privilege Escalation
mediumThe Gato GraphQL plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 19.2.3. This is due to insufficient restriction on the capabilities a user may grant themselves. This makes it possible for authenticated attackers, with subscriber-level access and above, to elevate their...
- CVSS:
- 6.3 (Wordfence)
- Affected:
- up to 19.2.3
- Fixed in:
- 19.2.4
- Disclosed:
- Sep 11, 2026