Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-119699— WPGraphQL Smart Cache before 2.3.3 Unbounded Persisted Query Storage DoS

Quick assessment

Affected

WPGraphQL WPGraphQL Smart Cache

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WPGraphQL Smart Cache 插件在 2.3.3 版本之前存在不受控的资源消耗漏洞。该漏洞允许未认证的攻击者通过“自动持久化查询”（Automatic Persisted Query）处理器，无限持久化存储查询文档。攻击者可发送具有相同 SHA-256 查询 ID 的不同查询（包括批量操作），导致表无限制增长，从而严重降低数据库性能。

CVSS 5.3 · Medium Updated Oct 30, 2026

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

WPGraphQL Smart Cache before 2.3.3 Unbounded Persisted Query Storage DoS

Source: CVE Program / CVE List V5

Vulnerability Description

WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to persist unlimited query documents via the Automatic Persisted Query handler. Attackers can send distinct queries with matching SHA-256 queryId values, including batched operations, to grow the wp_posts table without bound and degrade database performance.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

不加限制或调节的资源分配

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
WPGraphQL	WPGraphQL Smart Cache	0 ~ 2.3.3	-

II. Public POCs for CVE-2026-119699

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119699

请登录查看更多情报信息。

Other References for CVE-2026-119699 (6)

https://github.com/wp-graphql/wp-graphql/commit/80c021c42f4d4969e1b41760a08b4faf3c544a9e patch
https://github.com/wp-graphql/wp-graphql/blob/wp-graphql-smart-cache/v2.3.2/plugins/wp-graphql-smart-cache/src/Document.php technical-description
https://github.com/wp-graphql/wp-graphql product
https://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-5p5r-f66g-r4vp vendor-advisory
https://github.com/wp-graphql/wp-graphql/releases/tag/wp-graphql-smart-cache%2Fv2.3.3 release-notes
https://www.vulncheck.com/advisories/wpgraphql-smart-cache-before-2.3.3-unbounded-persisted-query-storage-dos third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-119699

Same Patch Batch · WPGraphQL · 2026-10-30 · 4 CVEs total

CVE-2026-119702	6.5 MEDIUM	WPGraphQL before 2.24.1 Missing Authorization via createComment Mutation
CVE-2026-119701	5.3 MEDIUM	WPGraphQL before 2.24.1 Email Flooding via Aliased sendPasswordResetEmail Mutations
CVE-2026-119700	5.3 MEDIUM	WPGraphQL before 2.24.2 Object Existence Disclosure via Media and Comment Mutations

IV. Related Vulnerabilities

Same product: WPGraphQL Smart Cache

CVE-2026-92099
WPGraphQL Smart Cache < 2.3.2 - Unauthenticated Persisted Qu

Same vendor: WPGraphQL

Same weakness: CWE-770