Vulnerability Description
WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to persist unlimited query documents via the Automatic Persisted Query handler. Attackers can send distinct queries with matching SHA-256 queryId values, including batched operations, to grow the wp_posts table without bound and degrade database performance.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/wp-graphql/wp-graphql
- https://github.com/wp-graphql/wp-graphql/blob/wp-graphql-smart-cache/v2.3.2/plug
- https://github.com/wp-graphql/wp-graphql/commit/80c021c42f4d4969e1b41760a08b4faf
- https://github.com/wp-graphql/wp-graphql/releases/tag/wp-graphql-smart-cache%2Fv
- https://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-5p5r-f66g-r4vp
- https://www.vulncheck.com/advisories/wpgraphql-smart-cache-before-2.3.3-unbounde
FAQ
What is CVE-2026-119699?
CVE-2026-119699 is a vulnerability with a CVSS score of 5.3 (MEDIUM). WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to persist unlimited query documents via the Automatic Persisted Qu...
How severe is CVE-2026-119699?
CVE-2026-119699 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-119699?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.