Uncontrolled Resource Consumption Vulnerability in WPGraphQL Smart Cache by WPGraphQL
CVE-2026-119699

6.9MEDIUM

Key Information:

Vendor

WPgraphql

Status
WPgraphql Smart Cache
Vendor
CVE Published:
30 October 2026

What is CVE-2026-119699?

The WPGraphQL Smart Cache prior to version 2.3.3 is susceptible to an uncontrolled resource consumption vulnerability. This enables unauthenticated attackers to send distinct query documents with identical SHA-256 queryId values through the Automatic Persisted Query handler. By exploiting this, attackers can continually add to the wp_posts table, leading to excessive growth and subsequent degradation of database performance. It is recommended that users update to the latest version to mitigate the risks associated with this vulnerability.

Affected Version(s)

WPGraphQL Smart Cache 0 < 2.3.3

References

https://github.com/wp-graphql/wp-graphql/security/advisor...
vendor-advisory
https://github.com/wp-graphql/wp-graphql/commit/80c021c42...
patch
https://github.com/wp-graphql/wp-graphql/blob/wp-graphql-...
technical-description

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

pnn219
Ryuuzen1011
.