CVE-2019-25060 — The WPGraphQL WordPress plugin before 0.3.5 doesn't properly restrict access to information about other users' roles on the affected site

Matched remediation archetype

Authorization bypass, IDOR, and cross-tenant access

This catalog composition supplies bounded fallback guidance. Explicitly reviewed curated workflows load with the complete record below.

Check exposure

• Map object and action authorization checks across API, UI, batch, import/export, and background-job paths.
• Identify tenant, ownership, role, and policy boundaries for affected resources and administrative operations.
• Use synthetic fixtures to compare intended access matrices without accessing another user's real data.

Remediate safely

• Enforce server-side authorization at each resource access and state transition using the authenticated principal and trusted tenant context.
• Scope data queries by tenant and ownership; treat client-supplied identifiers, roles, and policy claims as untrusted.
• Add deny-by-default policy tests for horizontal and vertical access across every affected transport.