CVE-2026-119699
WPGraphQL Smart Cache before 2.3.3 Unbounded Persisted Query Storage DoS
- State
- Published
- Severity
- 6.9 Medium
- Published
- Oct 30, 2026
- Updated
- Oct 30, 2026
- Reserved
- Oct 30, 2026
Description
WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to persist unlimited query documents via the Automatic Persisted Query handler. Attackers can send distinct queries with matching SHA-256 queryId values, including batched operations, to grow the wp_posts table without bound and degrade database performance.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L | VulnCheck |
Weaknesses
- CWE-770 Allocation of Resources Without Limits or Throttling
Affected Products
| Product | Versions |
|---|---|
WPGraphQL Smart CacheWPGraphQL |
|
References
- GitHub Security Advisory (GHSA-5p5r-f66g-r4vp)vendor-advisory
- https://github.com/wp-graphql/wp-graphql/commit/80c021c42f4d4969e1b41760a08b4faf3c544a9epatch
- https://github.com/wp-graphql/wp-graphql/blob/wp-graphql-smart-cache/v2.3.2/plugins/wp-graphql-smart-cache/src/Document.phptechnical-description
- WPGraphQL Smart Cache wp-graphql-smart-cache/v2.3.3 Release Notesrelease-notes
- https://github.com/wp-graphql/wp-graphqlproduct
- VulnCheck Advisory: WPGraphQL Smart Cache before 2.3.3 Unbounded Persisted Query Storage DoSthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.