CVE-2026-119701: WPGraphQL before 2.24.1 Email Flooding via Aliased sendPasswordResetEmail Mutations
WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to flood password reset emails by aliasing the sendPasswordResetEmail mutation. Attackers can send one HTTP request with many aliases, bypassing batchlimit, to exhaust mail provider quota and repeatedly rotate reset keys, blocking legitimate password recovery.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WPGraphQLto a version that resolves this vulnerability.Fixed in 2.24.1
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker can exploit it because the affected password-reset mutation does not require privileges. The attacker can submit a single HTTP request containing many aliased sendPasswordResetEmail mutations.
What is the practical impact on affected sites?
An attacker can consume the site's mail-provider quota by triggering large volumes of password-reset emails. Repeated requests can also rotate reset keys, preventing legitimate users from completing password recovery.
Are installations before 2.24.1 affected by default?
The issue affects WPGraphQL versions before 2.24.1 where the sendPasswordResetEmail mutation is available. The provided data does not identify any additional configuration prerequisite.
What should be done if upgrading cannot happen immediately?
The provided data does not specify a workaround. Until the affected component can be updated, monitor password-reset email volume and mail-provider quota usage for unexpected spikes.