CVE-2026-119699: WPGraphQL Smart Cache before 2.3.3 Unbounded Persisted Query Storage DoS
WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to persist unlimited query documents via the Automatic Persisted Query handler. Attackers can send distinct queries with matching SHA-256 queryId values, including batched operations, to grow the wpposts table without bound and degrade database performance.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using WPGraphQL Smart Cache versions before 2.3.3 are affected where the Automatic Persisted Query handler is available. The issue can be reached remotely without authentication.
What does an attacker need to do to trigger the resource exhaustion?
An attacker can submit distinct query documents with matching SHA-256 queryId values to persist unlimited documents. Batched operations can also be used to increase stored entries more quickly.
What is the operational impact to monitor for?
Persisted query documents can grow the wp_posts table without bound. This can degrade database performance and ultimately affect application availability.
How can administrators check whether exploitation may have occurred?
Review wp_posts table growth and look for an unexpected accumulation of persisted query documents associated with the Automatic Persisted Query handler. The provided data does not specify a distinct indicator beyond unbounded document storage and database growth.