Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for WPGraphQL Smart Cache by WPGraphQL

    CVE-2026-119699 (GCVE-0-2026-119699)

    Vulnerability from nvd – Published: 2026-10-30 15:16 – Updated: 2026-10-30 15:19
    VLAI
    Title
    WPGraphQL Smart Cache before 2.3.3 Unbounded Persisted Query Storage DoS
    Summary
    WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to persist unlimited query documents via the Automatic Persisted Query handler. Attackers can send distinct queries with matching SHA-256 queryId values, including batched operations, to grow the wp_posts table without bound and degrade database performance.
    Severity
    6.9 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
    5.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
    CWE
    • CWE-770 - Allocation of Resources Without Limits or Throttling
    Assigner
    VulnCheck CNA under the mitre root
    CNA scorecard B 84/100 over 7131 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    WPGraphQL WPGraphQL Smart Cache Affected: 0 , < 2.3.3 (semver)
    		Create a notification for this product.
    Date Public
    2026-10-14 00:00
    Credits
    pnn219 Ryuuzen1011
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WPGraphQL Smart Cache",
          "vendor": "WPGraphQL",
          "versions": [
            {
              "lessThan": "2.3.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "pnn219"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Ryuuzen1011"
        }
      ],
      "datePublic": "2026-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to persist unlimited query documents via the Automatic Persisted Query handler. Attackers can send distinct queries with matching SHA-256 queryId values, including batched operations, to grow the wp_posts table without bound and degrade database performance."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T15:19:17.609Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-5p5r-f66g-r4vp)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-5p5r-f66g-r4vp"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/wp-graphql/wp-graphql/commit/80c021c42f4d4969e1b41760a08b4faf3c544a9e"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/wp-graphql/wp-graphql/blob/wp-graphql-smart-cache/v2.3.2/plugins/wp-graphql-smart-cache/src/Document.php"
        },
        {
          "name": "WPGraphQL Smart Cache wp-graphql-smart-cache/v2.3.3 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/wp-graphql/wp-graphql/releases/tag/wp-graphql-smart-cache%2Fv2.3.3"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/wp-graphql/wp-graphql"
        },
        {
          "name": "VulnCheck Advisory: WPGraphQL Smart Cache before 2.3.3 Unbounded Persisted Query Storage DoS",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/wpgraphql-smart-cache-before-2.3.3-unbounded-persisted-query-storage-dos"
        }
      ],
      "title": "WPGraphQL Smart Cache before 2.3.3 Unbounded Persisted Query Storage DoS",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-119699",
    "datePublished": "2026-10-30T15:16:01.198Z",
    "dateReserved": "2026-10-30T14:49:20.718Z",
    "dateUpdated": "2026-10-30T15:19:17.609Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-119699 (GCVE-0-2026-119699)

    Vulnerability from cvelistv5 – Published: 2026-10-30 15:16 – Updated: 2026-10-30 15:19
    VLAI
    Title
    WPGraphQL Smart Cache before 2.3.3 Unbounded Persisted Query Storage DoS
    Summary
    WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to persist unlimited query documents via the Automatic Persisted Query handler. Attackers can send distinct queries with matching SHA-256 queryId values, including batched operations, to grow the wp_posts table without bound and degrade database performance.
    Severity
    6.9 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
    5.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
    CWE
    • CWE-770 - Allocation of Resources Without Limits or Throttling
    Assigner
    VulnCheck CNA under the mitre root
    CNA scorecard B 84/100 over 7131 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    WPGraphQL WPGraphQL Smart Cache Affected: 0 , < 2.3.3 (semver)
    		Create a notification for this product.
    Date Public
    2026-10-14 00:00
    Credits
    pnn219 Ryuuzen1011
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WPGraphQL Smart Cache",
          "vendor": "WPGraphQL",
          "versions": [
            {
              "lessThan": "2.3.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "pnn219"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Ryuuzen1011"
        }
      ],
      "datePublic": "2026-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to persist unlimited query documents via the Automatic Persisted Query handler. Attackers can send distinct queries with matching SHA-256 queryId values, including batched operations, to grow the wp_posts table without bound and degrade database performance."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T15:19:17.609Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-5p5r-f66g-r4vp)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-5p5r-f66g-r4vp"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/wp-graphql/wp-graphql/commit/80c021c42f4d4969e1b41760a08b4faf3c544a9e"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/wp-graphql/wp-graphql/blob/wp-graphql-smart-cache/v2.3.2/plugins/wp-graphql-smart-cache/src/Document.php"
        },
        {
          "name": "WPGraphQL Smart Cache wp-graphql-smart-cache/v2.3.3 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/wp-graphql/wp-graphql/releases/tag/wp-graphql-smart-cache%2Fv2.3.3"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/wp-graphql/wp-graphql"
        },
        {
          "name": "VulnCheck Advisory: WPGraphQL Smart Cache before 2.3.3 Unbounded Persisted Query Storage DoS",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/wpgraphql-smart-cache-before-2.3.3-unbounded-persisted-query-storage-dos"
        }
      ],
      "title": "WPGraphQL Smart Cache before 2.3.3 Unbounded Persisted Query Storage DoS",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-119699",
    "datePublished": "2026-10-30T15:16:01.198Z",
    "dateReserved": "2026-10-30T14:49:20.718Z",
    "dateUpdated": "2026-10-30T15:19:17.609Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}