PT-2026-133635
CVE-2026-119701
·
تاريخ النشر
2026-10-30
·
تاريخ التحديث
2026-10-30
الوصف من
CVSS 3.1
5.3
متوسطةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to flood password reset emails by aliasing the sendPasswordResetEmail mutation. Attackers can send one HTTP request with many aliases, bypassing batch limit, to exhaust mail provider quota and repeatedly rotate reset keys, blocking legitimate password recovery.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾