CVE-2026-119699
WPGraphQL Smart Cache before 2.3.3 Unbounded Persisted Query Storage DoS
- Published
- Updated
- Reserved
- Assigned by
- VulnCheck
Description
WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to persist unlimited query documents via the Automatic Persisted Query handler. Attackers can send distinct queries with matching SHA-256 queryId values, including batched operations, to grow the wp_posts table without bound and degrade database performance.
Timeline
ID reserved
By VulnCheck
Published
- 5 days later
· 5 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| VulnCheckCNA (assigner) | 4.0 | Medium6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N |
| VulnCheckCNA (assigner) | 3.1 | Medium5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| NVDNVD · Deferred | 4.0 | Medium6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
- EPSS (exploitation in 30 days)
- 0.45% · top 60% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.9.
Weakness
Affected products
WPGraphQL · WPGraphQL Smart Cache
- affected < 2.3.3
References (6)
- GitHub Security Advisory (GHSA-5p5r-f66g-r4vp) (opens in a new tab)vendor-advisory
- https://github.com/wp-graphql/wp-graphql/commit/80c021c42f4d4969e1b41760a08b4faf3c544a9e (opens in a new tab)patch
- https://github.com/wp-graphql/wp-graphql/blob/wp-graphql-smart-cache/v2.3.2/plugins/wp-graphql-smart-cache/src/Document.php (opens in a new tab)technical-description
- WPGraphQL Smart Cache wp-graphql-smart-cache/v2.3.3 Release Notes (opens in a new tab)release-notes
- https://github.com/wp-graphql/wp-graphql (opens in a new tab)product
- VulnCheck Advisory: WPGraphQL Smart Cache before 2.3.3 Unbounded Persisted Query Storage DoS (opens in a new tab)third-party-advisory
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-119699)Record last updated .