Description
Your web application's GraphQL implementation accepts non-JSON queries over GET requests, increasing the risk of Cross-Site Request Forgery (CSRF) attacks. While JSON-based POST requests are generally considered resistant to CSRF, non-JSON GET requests are more susceptible to this type of attacks.
Remediation
Restrict GraphQL queries to JSON-based POST requests to limit the CSRF attack surface.
References
Related Vulnerabilities
WordPress Plugin WordPress Gallery-NextGEN Gallery Cross-Site Request Forgery (3.28)
WordPress Plugin Google XML Sitemap for Videos Cross-Site Request Forgery (2.6.1)
WordPress Plugin TinyMCE Advanced Cross-Site Request Forgery (4.1)
WordPress Plugin WP Coder-add custom html, css and js code Cross-Site Request Forgery (2.5.2)
WordPress Plugin WP DSGVO Tools (GDPR) Cross-Site Request Forgery (2.2.18)