CVE-2026-119699

MediumCVSS 5.3

Published: 30/10/2026(UTC)Updated: 30/10/2026(UTC)Translated: 30/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.45%

39th percentile - higher than 39% of all known CVEs

Summary

WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to persist unlimited query documents via the Automatic Persisted Query handler. An attacker can send distinct queries with matching SHA-256 queryId values, including batched operations, to grow the wp_posts table without bound and degrade database performance.

Risk Assessment

An attacker can grow the database table without bound, leading to performance degradation, storage exhaustion and potential service unavailability.

Recommendation

Upgrade WPGraphQL Smart Cache to 2.3.3 or later and limit the number of stored query documents.

Other vulnerabilities in WPGraphQL Smart Cache

CVE-2026-92099Medium
The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authorisation or validate a caller-supplied query identifier before storing a persisted query from a request. This allows unauthenticated users to publish arbitrary query documents and claim query aliases before a site's own frontend registers them.

Original NVD description (English source)

WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to persist unlimited query documents via the Automatic Persisted Query handler. Attackers can send distinct queries with matching SHA-256 queryId values, including batched operations, to grow the wp_posts table without bound and degrade database performance.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS