GHSA-f5f8-v768-93c8: WPGraphQL before 2.24.1 Email Flooding via Aliased sendPasswordResetEmail Mutations
WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to flood password reset emails by aliasing the sendPasswordResetEmail mutation. Attackers can send one HTTP request with many aliases, bypassing batchlimit, to exhaust mail provider quota and repeatedly rotate reset keys, blocking legitimate password recovery.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WPGraphQLto a version that resolves this vulnerability.Fixed in 2.24.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using WPGraphQL versions before 2.24.1 are exposed if the sendPasswordResetEmail mutation is available. An attacker does not need authentication or user interaction.
What does an attacker need to do to exploit it?
The attacker can submit a single HTTP request containing many aliases of the sendPasswordResetEmail mutation. This bypasses the batch_limit and can generate repeated password-reset email requests.
What is the operational impact?
Exploitation can consume the site's mail-provider quota and repeatedly rotate password-reset keys. This can prevent legitimate users from completing password recovery.
How can I tell whether my site may be affected?
A site may be affected if it runs WPGraphQL before version 2.24.1 and permits the sendPasswordResetEmail mutation. Review GraphQL requests and mail activity for unusually large numbers of password-reset emails generated from single requests or in rapid succession.