Live › vulnerability › CVE-2026-119699
WPGraphQL Smart Cache before 2.3.3 stores persisted GraphQL query documents through its Automatic Persisted Query handler without limit. An unauthenticated attacker can send many distinct queries to grow the wp_posts table indefinitely and slow the database.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 16:31 UTC. All times on this page are UTC.
Sites running WordPress with WPGraphQL and WPGraphQL Smart Cache before 2.3.3 are exposed, because the APQ handler accepts queries from anonymous requests. Sites without this plugin, or with it at 2.3.3 or later, are not affected by this entry.
No product ranges from the sources yet.
wp plugin get wp-graphql-smart-cache --field=version2.3.3 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to persist unlimited query documents via the Automatic Persisted Query handler. Attackers can send distinct queries with matching SHA-256 queryId values, including batched operations, to grow the wp_posts table without bound and degrade database performance.
This page as .md · .json · in your agent: get_signal("CVE-2026-119699")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.