WPGraphQL

82 Quality Score

Active Installs

20/30

At 30,000 active installs and a popularity score of 67 over 30, WPGraphQL has a focused but relatively niche audience compared to broader API tools like JWT Authentication, which has 60,000 installs.

Update Freshness

25/25

A perfect 100 of 25 reflects the recent update on June 24, 2026 and active development under the WPGraphQL team, which is one of the most consistently maintained GraphQL projects in the WordPress ecosystem.

User Rating

15/15

The 98 out of 100 user rating from 48 reviews is exceptional and signals high satisfaction among the developer audience that has actually adopted it.

Support Health

8/15

A support health score of 50 out of 15 reflects zero tracked support threads, which suggests issues are handled primarily through GitHub or community channels rather than the WordPress.org support forum.

WP Compatibility

15/15

A perfect 100 of 15 is justified by tested compatibility with WordPress 7.0, a minimum requirement of WordPress 6.0, and PHP 7.4, giving it a forward-looking and reasonable baseline.

Scores higher than 88% of indexed plugins

About

WPGraphQL adds a flexible and powerful GraphQL API to WordPress, enabling efficient querying and interaction with your site's data.

Active Installs 30k+

Rating ★★★★½ 4.9/5

Last Updated 2026-09-22 6:37pm GMT

Requires WordPress 6.0+

Tested Up To 7.0.6

Requires PHP 7.4+

Security History

9 known vulnerabilities, all patched

2 Critical 1 High 6 Medium

Most recent: May 7, 2026

View details ▸

WPGraphQL <= 2.5.3 - Cross-Site Request Forgery Medium

May 7, 2026 Patched in ["2.5.4"] CVE-2025-68604

WPGraphQL < 2.11.1 - Unauthenticated SQL Injection High

April 21, 2026 Patched in ["2.11.1"] CVE-2026-40762

WPGraphQL <= 2.9.1 - Missing Authorization Medium

March 24, 2026 Patched in ["2.10"] CVE-2026-33290

WPGraphQL <= 1.14.5 - Authenticated (Editor+) Server-Side Request Forgery Medium

June 28, 2023 Patched in ["1.14.6"] CVE-2023-23684

WPGraphQL <= 1.3.5 - Denial of Service Medium

April 27, 2021 Patched in ["1.3.6"] CVE-2021-31157

WPGraphQL <= 0.3.4 - Information Exposure Medium

July 10, 2019 Patched in ["0.3.5"] CVE-2019-25060

WPGraphQL <= 0.2.3 - Unauthenticated Comment Creation Medium

May 8, 2019 Patched in ["0.3.0"] CVE-2019-9881

WPGraphQL <= 0.2.3 - Administrative User Creation Critical

May 8, 2019 Patched in ["0.3.0"] CVE-2019-9879

WPGraphQL <= 0.2.3 - Information Exposure Critical

May 8, 2019 Patched in ["0.3.0"] CVE-2019-9880

What It Does

WPGraphQL exposes your WordPress content, users, and settings through a GraphQL endpoint, letting frontend applications request exactly the data they need in a single query. It replaces or supplements the REST API with a strongly typed schema that works well with modern JavaScript frameworks like Next.js, Gatsby, and React Native. The plugin also serves as a foundation that other extensions build on for custom post types, ACF fields, and WooCommerce data.

Who It's For

Developers building headless or decoupled WordPress sites will get the most value, particularly teams using React, Next.js, or other GraphQL-ready frontends. It is also a solid fit for agencies building mobile apps, JAMstack sites, or multi-channel content distribution where efficient data fetching matters. Non-technical site owners and teams sticking with the block editor and PHP themes will see little benefit.

Who Should Skip It

If you are running a traditional WordPress site with a PHP theme, the WordPress REST API already covers your needs and this plugin adds unnecessary complexity. Small content-only sites that do not consume data from external apps will not see meaningful performance or workflow gains.

The Bottom Line

WPGraphQL is the de facto standard GraphQL layer for WordPress and earns its 82.25 quality score with excellent maintenance, top-tier user satisfaction, and strong forward compatibility. It is not for everyone, and traditional WordPress users should skip it, but for any developer building a decoupled or JAMstack site it is hard to beat. The only real gap is the absence of activity on the WordPress.org support forum, so plan to use GitHub for troubleshooting.

Pick this when you need token-based authentication for the REST API in a headless setup and do not require GraphQL's typed schema.

Disable WP REST API 81/100

Choose this for the opposite goal of hardening WordPress by completely turning off the REST API for non-logged-in users.

Contact Form to Any API 80/100

Use this when your main need is forwarding form submissions to external services rather than querying WordPress data from a frontend.

JWT Authentication for WP REST APIs 80/100

Select this for REST API authentication with OAuth or JWT support, especially in membership or enterprise environments.

Faust.js 76/100

Pick this when building a headless WordPress site with the official WP Engine framework that includes previews, routing, and authentication out of the box.