CVE tracker
CVE-2026-119699
CVE-2026-119699Medium 6.9
Research and translation in progress – available shortly.
Original description (NVD)
WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to persist unlimited query documents via the Automatic Persisted Query handler. Attackers can send distinct queries with matching SHA-256 queryId values, including batched operations, to grow the wp_posts table without bound and degrade database performance.
NVD references (6)
- https://github.com/wp-graphql/wp-graphql
- https://github.com/wp-graphql/wp-graphql/blob/wp-graphql-smart-cache/v2.3.2/plugins/wp-graphql-smart-cache/sr…
- https://github.com/wp-graphql/wp-graphql/commit/80c021c42f4d4969e1b41760a08b4faf3c544a9e
- https://github.com/wp-graphql/wp-graphql/releases/tag/wp-graphql-smart-cache%2Fv2.3.3
- https://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-5p5r-f66g-r4vp
- https://www.vulncheck.com/advisories/wpgraphql-smart-cache-before-2.3.3-unbounded-persisted-query-storage-dos
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.
Data: NVD (NIST), CISA KEV, FIRST EPSS – updated continuously.