Medium severity5.3NVD Advisory· Published Oct 30, 2026
CVE-2026-119699
CVE-2026-119699
Description
WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to persist unlimited query documents via the Automatic Persisted Query handler. Attackers can send distinct queries with matching SHA-256 queryId values, including batched operations, to grow the wp_posts table without bound and degrade database performance.
Patches
Vulnerability mechanics
References
5- github.com/wp-graphql/wp-graphql/blob/wp-graphql-smart-cache/v2.3.2/plugins/wp-graphql-smart-cache/src/Document.phpnvd
- github.com/wp-graphql/wp-graphql/commit/80c021c42f4d4969e1b41760a08b4faf3c544a9envd
- github.com/wp-graphql/wp-graphql/releases/tag/wp-graphql-smart-cache%2Fv2.3.3nvd
- github.com/wp-graphql/wp-graphql/security/advisories/GHSA-5p5r-f66g-r4vpnvd
- www.vulncheck.com/advisories/wpgraphql-smart-cache-before-2.3.3-unbounded-persisted-query-storage-dosnvd
News mentions
0No linked articles in our index yet.