CVE-2026-119699
Mở trang đầy đủCVSS 5.3 MEDIUM
WPGraphQL Smart Cache before 2.3.3 Unbounded Persisted Query Storage DoS
Mô tả
WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to persist unlimited query documents via the Automatic Persisted Query handler. Attackers can send distinct queries with matching SHA-256 queryId values, including batched operations, to grow the wp_posts table without bound and degrade database performance.
Điểm và phân loại
- CVSS
- 5.3 MEDIUM v3.1
- Nguồn điểm
- NVD
- Mức độ (theo nguồn)
- MEDIUM
- EPSS
- —
- CWE
- CWE-770
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Ảnh hưởng
Sản phẩm
- WPGraphQL WPGraphQL Smart Cache
Vì sao bị lọc
- CVSS 5.3 < 8.0 và không thuộc CISA KEV
Loại tác động
Không nhận ra loại tác động nào từ CWE, vector hay mô tả.
Dữ liệu riêng của nguồn
- CVE.org · Đơn vị cấp mã
- VulnCheck
Tham khảo
- https://github.com/wp-graphql/wp-graphql
- https://github.com/wp-graphql/wp-graphql/blob/wp-graphql-smart-cache/v2.3.2/plugins/wp-graphql-smart-cache/src/Document.php
- https://github.com/wp-graphql/wp-graphql/commit/80c021c42f4d4969e1b41760a08b4faf3c544a9e
- https://github.com/wp-graphql/wp-graphql/releases/tag/wp-graphql-smart-cache%2Fv2.3.3
- https://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-5p5r-f66g-r4vp
- https://www.vulncheck.com/advisories/wpgraphql-smart-cache-before-2.3.3-unbounded-persisted-query-storage-dos