![[CVE-2026-40762] Unauthenticated SQL Injection in WPGraphQL < 2.11.1](https://opknqtwjsqtyzqkwogxi.supabase.co/storage/v1/object/public/avatars/3053e0e8-367c-45a7-a679-3eb846e739cc/covers/1783504288480-v2bciladi2l.png)
SQL Injection (CWE-89)CVSS 9.1€150 PRO
[CVE-2026-40762] Unauthenticated SQL Injection in WPGraphQL < 2.11.1
An unauthenticated time-based blind SQL injection was confirmed in a public WPGraphQL `node(id:)` resolver affected by CVE-2026-40762. The issue was triggered by passing a crafted base64 Relay global ID that decoded to a malicious `user:<value>` identifier and reached a MySQL query path.
Description
An unauthenticated attacker can execute blind time-based SQL injection through the WPGraphQL node(id:) resolver on:
https://[REDACTED-HOST]/blog/graphql/
The vulnerable value is the base64 Relay global ID passed to node(id:). When the ID decodes to a user:<value> global ID, the attacker-controlled <value> reaches the WordPress/WPGraphQL user-loader SQL path and is evaluated inside a MySQL query.