5.3Orta
CVE-2026-119699WPGraphQL Smart Cache before 2.3.3 Unbounded Persisted Query Storage DoS
Açıklama
WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to persist unlimited query documents via the Automatic Persisted Query handler. Attackers can send distinct queries with matching SHA-256 queryId values, including batched operations, to grow the wp_posts table without bound and degrade database performance.
Zayıflık türü (CWE):
CWE-770
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| WPGraphQL | WPGraphQL Smart Cache | < 2.3.3 |
Kaynaklar ve yamalar
- GitHub Security Advisory (GHSA-5p5r-f66g-r4vp) vendor-advisory
- https://github.com/wp-graphql/wp-graphql/commit/80c021c42f4d4969e1b41760a08b4faf3c544a9e patch
- https://github.com/wp-graphql/wp-graphql/blob/wp-graphql-smart-cache/v2.3.2/plugins/wp-graphql-smart-cache/sr… technical-description
- WPGraphQL Smart Cache wp-graphql-smart-cache/v2.3.3 Release Notes release-notes
- https://github.com/wp-graphql/wp-graphql product
- VulnCheck Advisory: WPGraphQL Smart Cache before 2.3.3 Unbounded Persisted Query Storage DoS third-party-advisory