Description
Your web application's GraphQL implementation accepts non-JSON queries over POST requests, increasing the risk of Cross-Site Request Forgery (CSRF) attacks. The request was sent with Content-Type application/x-www-form-urlencoded and succeeded.
Remediation
Restrict GraphQL queries to JSON-based POST requests to limit the CSRF attack surface.
References
Related Vulnerabilities
WordPress Plugin Redux Framework Cross-Site Request Forgery (4.1.20)
WordPress Plugin ZX_CSV Upload Multiple Vulnerabilities (1)
Unauthorized Access to a web app installer
WordPress Plugin PictoBrowser Cross-Site Request Forgery (0.3.1)
WordPress Plugin WP Maintenance Mode Cross-Site Request Forgery (1.8.7)