{"id":"CVE-2026-119701","kind":"vulnerability","aliases":["CVE-2026-119701"],"related":[],"title":"WPGraphQL: missing rate limit lets anyone flood password reset emails","description":"WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to flood password reset emails by aliasing the sendPasswordResetEmail mutation. Attackers can send one HTTP request with many aliases, bypassing batch_limit, to exhaust mail provider quota and repeatedly rotate reset keys, blocking legitimate password recovery.","summary":"WPGraphQL, a GraphQL plugin for WordPress, lets an unauthenticated attacker send one request with many aliased sendPasswordResetEmail mutations, bypassing the batch limit. The result is mail quota exhaustion and repeated reset-key rotation that blocks legitimate password recovery.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wpgraphql"],"not_affected_if":["wpgraphql-2.24.1-or-later","wpgraphql-not-installed"],"how_to_check":"- Check the installed WPGraphQL version in the WordPress plugins screen or the plugin header in `wp-content/plugins/wp-graphql/wp-graphql.php`\n- Confirm whether the GraphQL endpoint is publicly reachable (unknown whether the sources define a default)","fix":"- WPGraphQL: upgrade to `2.24.1` or later","status":"open","published_at":"2026-10-30T16:17:50+00:00","first_seen_at":"2026-10-30T16:31:26+00:00","triaged_at":"2026-10-30T16:32:15+00:00","updated_at":"2026-10-30T16:32:15+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T16:32:15Z","model":"claude-haiku-5-5","output":{"fix":"- WPGraphQL: upgrade to `2.24.1` or later","reach":"internet","title":"WPGraphQL: missing rate limit lets anyone flood password reset emails","impact":"low","summary":"WPGraphQL, a GraphQL plugin for WordPress, lets an unauthenticated attacker send one request with many aliased sendPasswordResetEmail mutations, bypassing the batch limit. The result is mail quota exhaustion and repeated reset-key rotation that blocks legitimate password recovery.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wpgraphql","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"attacker blocks password recovery and exhausts mail sending quota","analyst_note":"","how_to_check":"- Check the installed WPGraphQL version in the WordPress plugins screen or the plugin header in `wp-content/plugins/wp-graphql/wp-graphql.php`\n- Confirm whether the GraphQL endpoint is publicly reachable (unknown whether the sources define a default)","plain_action":"","needs_analyst":false,"not_affected_if":["wpgraphql-not-installed","wpgraphql-2.24.1-or-later"],"who_is_affected":"Sites running WPGraphQL before 2.24.1 with its GraphQL endpoint reachable from the internet, where the sendPasswordResetEmail mutation is exposed. The sources do not say whether the mutation is enabled by default, so teams should confirm their configuration. Sites that do not run WPGraphQL are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000721,"input_tokens":4168,"output_tokens":608,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119701':13A,16A '-2026':12A,15A '2.24.1':64C 'alias':38B,81C,93C 'allow':72C 'anyon':6A 'attack':32B,74C,85C 'batch':43B,95C 'block':58B,107C 'bypass':41B,94C 'contain':65C 'cve':11A,14A 'email':10A,79C 'exhaust':50B,98C 'flood':7A,76C 'graphql':25B 'host':20B 'http':89C 'key':55B,106C 'legitim':59B,108C 'let':5A,29B 'limit':4A,44B,69C,96C 'mail':48B,99C 'mani':37B,92C 'miss':2A,67C 'mutat':40B,84C 'one':34B,88C 'packag':17B 'password':8A,60B,77C,109C 'plugin':26B 'provid':100C 'quota':49B,101C 'rate':3A,68C 'recoveri':61B,110C 'repeat':52B,103C 'request':35B,90C 'reset':9A,54B,78C,105C 'reset-key':53B 'result':46B 'rotat':56B,104C 'self':19B 'self-host':18B 'send':33B,87C 'sendpasswordresetemail':39B,83C 'unauthent':31B,73C 'vulner':70C 'wordpress':21B,28B 'wpgraphql':1A,22B,23B,62C","nicknames":[],"mitigations":[],"who_affected":"Sites running WPGraphQL before 2.24.1 with its GraphQL endpoint reachable from the internet, where the sendPasswordResetEmail mutation is exposed. The sources do not say whether the mutation is enabled by default, so teams should confirm their configuration. Sites that do not run WPGraphQL are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T16:17:50+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119701","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119701","severity":null,"published_at":"2026-10-30T16:17:50+00:00","modified_at":"2026-10-30T16:17:50+00:00","first_seen_at":"2026-10-30T16:31:26+00:00","fetched_at":"2026-10-30T16:31:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}