AIKIDO-2025-10948

TL;DR

Affected versions of this package are vulnerable to Insecure Caching of Authenticated GraphQL Requests due to incorrectly determining a user's authentication state via is_user_logged_in() after the WordPress core had already reset the current user to zero within the same request, which could allow an attacker to exploit this by causing an authenticated user (e.g., an administrator) to execute a specific GraphQL query without a nonce, typically via a direct URL containing a particular query, thereby caching the private response data (like draft posts) and subsequently serving that sensitive data from cache to any unauthenticated visitor.