{"id":"CVE-2026-119699","kind":"vulnerability","aliases":["CVE-2026-119699"],"related":[],"title":"WPGraphQL Smart Cache: unauthenticated requests grow database table without bound","description":"WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to persist unlimited query documents via the Automatic Persisted Query handler. Attackers can send distinct queries with matching SHA-256 queryId values, including batched operations, to grow the wp_posts table without bound and degrade database performance.","summary":"WPGraphQL Smart Cache before 2.3.3 stores persisted GraphQL query documents through its Automatic Persisted Query handler without limit. An unauthenticated attacker can send many distinct queries to grow the wp_posts table indefinitely and slow the database.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wpgraphql"],"not_affected_if":["no-wpgraphql","plugin-at-2.3.3-or-later"],"how_to_check":"- Check the installed Smart Cache plugin version in the WordPress plugins screen or `wp plugin get wp-graphql-smart-cache --field=version`\n- Confirm whether the WPGraphQL endpoint accepts Automatic Persisted Queries from unauthenticated visitors\n- Watch the size of the wp_posts table for unexplained growth","fix":"- WPGraphQL Smart Cache: move to `2.3.3` or later","status":"open","published_at":"2026-10-30T16:17:50+00:00","first_seen_at":"2026-10-30T16:31:26+00:00","triaged_at":"2026-10-30T16:32:16+00:00","updated_at":"2026-10-30T16:32:16+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T16:32:16Z","model":"claude-haiku-5-5","output":{"fix":"- WPGraphQL Smart Cache: move to `2.3.3` or later","reach":"internet","title":"WPGraphQL Smart Cache: unauthenticated requests grow database table without bound","impact":"low","summary":"WPGraphQL Smart Cache before 2.3.3 stores persisted GraphQL query documents through its Automatic Persisted Query handler without limit. An unauthenticated attacker can send many distinct queries to grow the wp_posts table indefinitely and slow the database.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wpgraphql","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"unbounded database growth degrades site performance over time","analyst_note":"","how_to_check":"- Check the installed Smart Cache plugin version in the WordPress plugins screen or `wp plugin get wp-graphql-smart-cache --field=version`\n- Confirm whether the WPGraphQL endpoint accepts Automatic Persisted Queries from unauthenticated visitors\n- Watch the size of the wp_posts table for unexplained growth","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-at-2.3.3-or-later","no-wpgraphql"],"who_is_affected":"Sites running WordPress with WPGraphQL and WPGraphQL Smart Cache before 2.3.3 are exposed, because the APQ handler accepts queries from anonymous requests. Sites without this plugin, or with it at 2.3.3 or later, are not affected by this entry.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000716,"input_tokens":4161,"output_tokens":599,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119699':13A,16A '-2026':12A,15A '-256':94C '2.3.3':27B,64C 'allow':72C 'attack':43B,74C,86C 'automat':35B,82C 'batch':98C 'bound':10A,107C 'cach':3A,25B,62C 'consumpt':69C 'contain':65C 'cve':11A,14A 'databas':7A,59B,110C 'degrad':109C 'distinct':47B,89C 'document':32B,79C 'graphql':30B 'grow':6A,50B,101C 'handler':38B,85C 'host':20B 'includ':97C 'indefinit':55B 'limit':40B 'mani':46B 'match':92C 'oper':99C 'packag':17B 'perform':111C 'persist':29B,36B,76C,83C 'post':53B,104C 'queri':31B,37B,48B,78C,84C,90C 'queryid':95C 'request':5A 'resourc':68C 'self':19B 'self-host':18B 'send':45B,88C 'sha':93C 'slow':57B 'smart':2A,24B,61C 'store':28B 'tabl':8A,54B,105C 'unauthent':4A,42B,73C 'uncontrol':67C 'unlimit':77C 'valu':96C 'via':80C 'vulner':70C 'without':9A,39B,106C 'wordpress':21B 'wp':52B,103C 'wpgraphql':1A,22B,23B,60C","nicknames":[],"mitigations":[],"who_affected":"Sites running WordPress with WPGraphQL and WPGraphQL Smart Cache before 2.3.3 are exposed, because the APQ handler accepts queries from anonymous requests. Sites without this plugin, or with it at 2.3.3 or later, are not affected by this entry.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T16:17:50+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119699","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119699","severity":null,"published_at":"2026-10-30T16:17:50+00:00","modified_at":"2026-10-30T16:17:50+00:00","first_seen_at":"2026-10-30T16:31:26+00:00","fetched_at":"2026-10-30T16:31:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}