WPGraphQL

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price.

1. ★★★★★ con

   1.4y ago

   GraphQL vs. REST API 10 : 0 Thank you for this plugin. Building my headless application with WPGraphQL is fun. The repl interface to test queries is A+.

   Read on wp.org ↗
2. ★★★★★ psychosispicks

   3.0y ago

   I’m so glad I decided to transition to a headless WP, and WPGraphQL made this possible, convenient and super fast.

   Read on wp.org ↗
3. ★★★★★ benknight

   3.2y ago

   I operate a large blog that uses WordPress as a headless CMS with a Next.JS frontend, which is largely enabled by this plugin. Let me just say first that creating an entire alternative third-party data API is an ambitious undertaking and I appreciate all the work the authors have put into it. But as a developer I have to throw out a word of caution that this plugin often has major bugs that can have critical impact on your production website. For example after a recent minor update we discovered a bug where any URL with a special character in it started returning a 404, causing several of our pages to suddenly become unavailable to users and delisted from Google, and this went on for many months before we realized it. There have been many similar instances. My general approach is to lean more on WordPress’s REST API over time which is more reliable since it’s maintained by the WordPress team, and only use WPGraphQL when it’s necessary. Also recommend turning off auto-updates and test your website extremely thoroughly after any upgrade. This topic was modified 3 years, 1 month ago by benknight. This topic was modified 3 years, 1 month ago by benknight.

   Read on wp.org ↗
4. ★★★★★ chisnghiax

   4.0y ago

   Great!

   Read on wp.org ↗
5. ★★★★★ 2cubed

   4.0y ago

   One of the best plugins for WordPress. It’s right up there with ACF!

   Read on wp.org ↗
6. ★★★★★ mauretto1978

   4.2y ago

   Great plugin, everyone should use it. The IDE is a valuable plus, and it can be used to learn GraphQL from scratch. From the developer’s point of view, the plugin is super easy to extend, thanks to the great documentation. Don’t forget to check the official YouTube channel. If you need extra support for custom post types and metas, I just released v1.0.70 of my plugin ACPT with full support to WPGraphQL. Thank you so much John! This topic was modified 4 years, 1 month ago by mauretto1978.

   Read on wp.org ↗
7. ★★★★★ Camilo

   4.3y ago

   Great tool for getting data from your WP into your SPA. I had some trouble with a conflicting plugin (Post Types Order) that caused unexpted results when paginating my posts but the support provided by both Jason Bahl and David Levine was absolutely top notch and I managed to resolve the issue within hours.

   Read on wp.org ↗
8. ★★★★★ turboloop

   4.4y ago

   Over a year ago I switched from using REST to this plugin. I mainly build Angular Apps using Apollo client. Works perfectly fine and increases development speed.

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 2.17.0 New Features add hour, minute, and second to DateInput for sub-day date filtering ( #3967 ) deps: bump the npm-prod-minor-patch group across 1 directory with 5 updates ( #3946 ) deps: bump the npm-prod-minor-patch group 2.17.0
2. — Version 2.16.0 New Features deps: bump the npm-prod-minor-patch group across 1 directory with 5 updates ( #3905 ) Bug Fixes deps-dev: bump the npm-dev-minor-patch group across 1 directory with 7 updates ( #3894 ) 2.16.0
3. — Version 2.15.1 Security prevent user enumeration via the deprecated SendPasswordResetEmailPayload.user field; it is now gated on the list_users capability. See GHSA-jhh7-832h-f8hv Bug Fixes ci: deploy WordPress.org assets via ASSETS_DI 2.15.1
4. — Version 2.15.0 New Features deps: bump @wordpress/hooks from 3.58.0 to 4.44.0 ( #3853 ) deps: bump the npm-prod-minor-patch group across 1 directory with 7 updates ( #3865 ) resolve WPGraphQL settings outside the admin (at the /graphql 2.15.0
5. — Version 2.14.1 Bug Fixes Allow compatible interface field override with register_graphql_field() ( #3539 ) 2.14.1
6. — Version 2.14.0 New Features deps: bump sanitize-html from 2.17.3 to 2.17.4 ( #3831 ) deps: bump the npm-prod-minor-patch group across 1 directory with 4 updates ( #3826 ) deps: bump the npm-prod-minor-patch group with 4 updates ( #3820 2.14.0

9 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. Medium · 4.3 WPGraphQL <= 2.5.3 - Cross-Site Request Forgery ↗
   2026-05-07 CVE-2025-68604 Cross-Site Request Forgery (CSRF) Affects <= 2.5.3 Patched in 2.5.4
2. High · 7.5 WPGraphQL < 2.11.1 - Unauthenticated SQL Injection ↗
   2026-04-21 CVE-2026-40762 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects < 2.11.1 Patched in 2.11.1
3. Medium · 4.3 WPGraphQL <= 2.9.1 - Missing Authorization ↗
   2026-03-24 CVE-2026-33290 Missing Authorization Affects <= 2.9.1 Patched in 2.10
4. Medium · 5.5 WPGraphQL <= 1.14.5 - Authenticated (Editor+) Server-Side Request Forgery ↗
   2023-06-28 CVE-2023-23684 Server-Side Request Forgery (SSRF) Affects <= 1.14.5 Patched in 1.14.6
5. Medium · 5.3 WPGraphQL <= 1.3.5 - Denial of Service ↗
   2021-04-27 CVE-2021-31157 Uncontrolled Resource Consumption Affects <= 1.3.5 Patched in 1.3.6
6. Medium · 6.5 WPGraphQL <= 0.3.4 - Information Exposure ↗
   2019-07-10 CVE-2019-25060 Improper Access Control Affects <= 0.3.4 Patched in 0.3.5
7. Medium · 5.3 WPGraphQL <= 0.2.3 - Unauthenticated Comment Creation ↗
   2019-05-08 CVE-2019-9881 Missing Authorization Affects <= 0.2.3 Patched in 0.3.0
8. Critical · 9.8 WPGraphQL <= 0.2.3 - Administrative User Creation ↗
   2019-05-08 CVE-2019-9879 Improper Privilege Management Affects <= 0.2.3 Patched in 0.3.0
9. Critical · 9.1 WPGraphQL <= 0.2.3 - Information Exposure ↗
   2019-05-08 CVE-2019-9880 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 0.2.3 Patched in 0.3.0

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0

Translated into 3 languages, 0 at 90% or more

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2023-11-12 20K+ → 30K+ up after 2 days in tier
2. 2023-11-10 30K+ → 20K+ down after 1 days in tier
3. 2023-11-09 20K+ → 30K+ up

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• WPGraphQL IDE 1K+ installs · 3.6★ · 3 shared tags B
• CoCart – Headless REST API for WooCommerce 900+ installs · 4.5★ · 3 shared tags A
• CoCart CORS Support 400+ installs · 3.6★ · 3 shared tags D
• W WPGraphQL Blocks 300+ installs · 3.6★ · 3 shared tags C
• CoCart JWT Authentication 200+ installs · 3.6★ · 3 shared tags B
• CoCart – Cart API Enhanced 200+ installs · 4.0★ · 3 shared tags D

Embed this report card

Drop a live Pulse card for WPGraphQL into a readme, a review or a deck. It updates itself.

WPGraphQL: 30K+ active installs, 4.9★ (48 reviews). Plugin Pulse (WP Mayor), as of 2026-08-25. https://plugins.wpmayor.com/plugin/wp-graphql