Description

WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to persist unlimited query documents via the Automatic Persisted Query handler. Attackers can send distinct queries with matching SHA-256 queryId values, including batched operations, to grow the wp_posts table without bound and degrade database performance.

Related CPE's

Could not find any relations

References

https://github.com/wp-graphql/wp-graphql

https://github.com/wp-graphql/wp-graphql/blob/wp-graphql-smart-cache/v2.3.2/plugins/wp-graphql-smart-cache/src/Document.php

https://github.com/wp-graphql/wp-graphql/commit/80c021c42f4d4969e1b41760a08b4faf3c544a9e

https://github.com/wp-graphql/wp-graphql/releases/tag/wp-graphql-smart-cache%2Fv2.3.3

https://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-5p5r-f66g-r4vp

https://www.vulncheck.com/advisories/wpgraphql-smart-cache-before-2.3.3-unbounded-persisted-query-storage-dos

Weaknesses

[email protected]

Primary
CWE-770

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

5.3 · Medium

Information

Source identifier

[email protected]

Vulnerability status

Deferred

Published

2026-10-30T16:17:50.393Z

4 hours ago

Last modified

2026-10-30T19:23:25.493Z

1 hour ago