Skip to content
PluginCanary

WPGraphQL

by Jason Bahl · 30,000+ active installs · Checked 4 Nov 2026
Healthy

Healthy: 4 vulnerabilities published in the last 24 months.

85/ 100 Canary Score
Sub-scores for WPGraphQL
Ownership100
Maintenance100
Security75
Support70
Reputation70

How the score works

Active signals

Facts we detected, with links to the source.

  • InfoSEC-34 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
plugin-master8 Jul 2020 to 8 Jul 2020, 1 commits
jasonbahl14 Nov 2020 to 3 Nov 2026, 193 commits

2 committers recorded. No ownership changes recorded since 3 Nov 2026.

Maintenance

Last release
today
Releases, 24 months
59
Tested up to
7.0 vs 7.1
Requires PHP
7.4 supported 8.2+
Releases per quarter for WPGraphQL
Q1 20244
Q2 20245
Q3 20245
Q4 20243
Q1 20259
Q2 20255
Q3 20251
Q4 20256
Q1 20267
Q2 202611
Q3 202611
Q4 20266

Last release 3 Nov 2026. Tested up to 7.0, 1 major version behind WordPress 7.1.

Support

Support history appears after our first snapshots of the forum counts.

Security record

PublishedIssueCVSSAffectedFixed inDays to patch
13 Oct 2026WPGraphQL <= 2.24.0 - Unauthenticated Information Exposure5.3<= 2.24.0Not affectedn/a
7 May 2026WPGraphQL <= 2.5.3 - Cross-Site Request Forgery4.3<= 2.5.32.5.40
21 Apr 2026WPGraphQL < 2.11.1 - Unauthenticated SQL Injection7.5< 2.11.12.11.10
24 Mar 2026WPGraphQL <= 2.9.1 - Missing Authorization4.3<= 2.9.12.10n/a
28 Jun 2023WPGraphQL <= 1.14.5 - Authenticated (Editor+) Server-Side Request Forgery5.5<= 1.14.51.14.63
27 Apr 2021WPGraphQL <= 1.3.5 - Denial of Service5.3<= 1.3.51.3.64
10 Jul 2019WPGraphQL <= 0.3.4 - Information Exposure6.5<= 0.3.40.3.5n/a
8 May 2019WPGraphQL <= 0.2.3 - Information Exposure9.1<= 0.2.30.3.0n/a
8 May 2019WPGraphQL <= 0.2.3 - Administrative User Creation9.8<= 0.2.30.3.0n/a
8 May 2019WPGraphQL <= 0.2.3 - Unauthenticated Comment Creation5.3<= 0.2.30.3.0n/a

Source: Wordfence Intelligence.

Reputation

Average rating 5.0 in Q1 2025.

Rating distribution
5 star46
4 star1
3 star1
2 star0
1 star0

Momentum

30,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for WPGraphQL
4 May 20267,528
11 May 20268,230
18 May 202617,578
25 May 20268,460
1 Jun 202612,467
8 Jun 202612,467
15 Jun 20268,158
22 Jun 202611,143
29 Jun 20267,795
6 Jul 20268,062
13 Jul 20267,643
20 Jul 202611,561
27 Jul 20268,345
3 Aug 202612,246
10 Aug 20267,190
17 Aug 202612,802
24 Aug 20266,612
31 Aug 202625,774
7 Sep 202612,134
14 Sep 202613,127
21 Sep 202614,818
28 Sep 20268,785
5 Oct 20269,223
12 Oct 202619,652
19 Oct 202616,999
26 Oct 202615,169
2 Nov 20262,140

Weekly downloads over the last 4 weeks are 19% above the 27-week average.

Healthier alternatives

Same category, higher Canary Score. Never sponsored.

MCP AdapterScore 93 · 60,000+WP-SCSSScore 93 · 40,000+Show Pages IDsScore 93 · 10,000+WP ResetScore 92 · 300,000+Query MonitorScore 91 · 200,000+

Facts

Version2.26.1
AuthorJason Bahl
Added14 Nov 2020
Last updated3 Nov 2026
Active installs30,000+
Requires WordPress6.0
Tested up to7.0.8
Requires PHP7.4
CategoryDeveloper Tools & Customization > API & Webhook Integration
Tagsreact, GraphQL, headless, rest-api, decoupled

Other plugins by this author: WPGraphQL for ACF, WPGraphQL Smart Cache

Questions

Is WPGraphQL still maintained?

WPGraphQL was last updated on 3 Nov 2026. Its Canary status is Healthy.

Is WPGraphQL safe?

WPGraphQL has no open unpatched vulnerabilities on record. 4 vulnerabilities were published in the last 24 months. Its Canary status is Healthy.

Who owns WPGraphQL?

The wordpress.org author is Jason Bahl. Recent committers: jasonbahl, plugin-master. We have recorded no ownership change.

What can I use instead of WPGraphQL?

Plugins in the same category with a higher Canary Score: MCP Adapter, WP-SCSS, Show Pages IDs, WP Reset, Query Monitor.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews, Wordfence Intelligence.Plugin data refreshed 4 Nov 2026.Report a data issue