CVE-2026-119699
Received Received - Intake

Uncontrolled Resource Consumption in WPGraphQL Smart Cache

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to persist unlimited query documents via the Automatic Persisted Query handler. Attackers can send distinct queries with matching SHA-256 queryId values, including batched operations, to grow the wp_posts table without bound and degrade database performance.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119699
EUVD
EUVD-2026-114104

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
WPGraphQL WPGraphQL Smart Cache 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

WPGraphQL Smart Cache before 2.3.3 has an uncontrolled resource consumption flaw in its Automatic Persisted Query handler. Unauthenticated attackers can exploit this by sending distinct queries with matching SHA-256 queryId values, including batched operations, to cause unlimited growth of the wp_posts table. This degrades database performance by consuming excessive storage and resources.

Detection Guidance

Check for unusually large wp_posts table sizes or excessive query documents in WPGraphQL Smart Cache. Monitor for repeated queries with matching SHA-256 queryId values, including batched operations. Review database logs for abnormal growth patterns.

Impact Analysis

This vulnerability can lead to severe database performance degradation, causing slow response times or crashes for your WordPress site. It may also result in increased hosting costs due to excessive storage usage and potential downtime if the database becomes overwhelmed.

Mitigation Strategies

Update WPGraphQL Smart Cache to version 2.3.3 or later. Disable the Automatic Persisted Query handler if not required. Implement rate limiting on API endpoints to prevent excessive query submissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119699. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart