CVE-2026-92099

Received Received - Intake

Unauthenticated Query Injection in WPGraphQL Smart Cache

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: WPScan

Description

The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authorisation or validate a caller-supplied query identifier before storing a persisted query from a request, allowing unauthenticated users to publish arbitrary query documents and claim query aliases before a site's own frontend registers them.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-92099

Affected Vendors & Products

Vendor	Product	Version / Range
wpgraphql	smart_cache	to 2.3.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability in the WPGraphQL Smart Cache WordPress plugin before version 2.3.2 allows unauthenticated users to store arbitrary query documents and claim query aliases without proper authorization or validation. This happens because the plugin does not check if a caller-supplied query identifier is valid before accepting it.

Detection Guidance

This vulnerability allows unauthenticated users to store arbitrary query documents via the WPGraphQL Smart Cache plugin before 2.3.2. To detect it, check for unusual GraphQL queries or cached queries in the plugin's storage. Inspect network traffic for POST requests to /graphql with unexpected query payloads. Review plugin files for unauthorized query documents in cache directories.

Impact Analysis

An attacker could exploit this to publish malicious queries under your site's registered aliases, potentially leading to unauthorized data access, cache poisoning, or denial of service by overwhelming the system with invalid queries.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it involves unauthorized query storage rather than data exposure or privacy violations. However, if exploited, it could enable attackers to manipulate cached queries, potentially leading to indirect compliance risks if sensitive data is exposed or modified through crafted queries.

Mitigation Strategies

Update the WPGraphQL Smart Cache plugin to version 2.3.2 or later to address the unauthenticated query storage issue.

Hi! I’m here to help you understand CVE-2026-92099. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70