CVE-2026-92099: WPGraphQL Smart Cache < 2.3.2 - Unauthenticated Persisted Query Registration and Alias Squatting
The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authorisation or validate a caller-supplied query identifier before storing a persisted query from a request, allowing unauthenticated users to publish arbitrary query documents and claim query aliases before a site's own frontend registers them.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated user who can send requests to the affected plugin's persisted-query registration functionality can register arbitrary query documents and claim aliases.
What versions are affected?
WPGraphQL Smart Cache versions before 2.3.2 are affected. Upgrading to 2.3.2 or later addresses the vulnerable version range.
What is the practical impact of alias squatting?
An attacker can register a query identifier before the site's frontend does, causing that alias to point to an attacker-supplied query document rather than the query the frontend intended to register.