Live › vulnerability › CVE-2026-119701
WPGraphQL, a GraphQL plugin for WordPress, lets an unauthenticated attacker send one request with many aliased sendPasswordResetEmail mutations, bypassing the batch limit. The result is mail quota exhaustion and repeated reset-key rotation that blocks legitimate password recovery.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 16:31 UTC. All times on this page are UTC.
Sites running WPGraphQL before 2.24.1 with its GraphQL endpoint reachable from the internet, where the sendPasswordResetEmail mutation is exposed. The sources do not say whether the mutation is enabled by default, so teams should confirm their configuration. Sites that do not run WPGraphQL are not affected.
No product ranges from the sources yet.
wp-content/plugins/wp-graphql/wp-graphql.php2.24.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to flood password reset emails by aliasing the sendPasswordResetEmail mutation. Attackers can send one HTTP request with many aliases, bypassing batch_limit, to exhaust mail provider quota and repeatedly rotate reset keys, blocking legitimate password recovery.
This page as .md · .json · in your agent: get_signal("CVE-2026-119701")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.