Ryuuzen1011

An uncontrolled resource consumption issue exists within the Automatic Persisted Query handler. Unauthenticated attackers can persist unlimited query documents by sending distinct queries that share matching SHA-256 `queryId` values, including batched operations. This process causes the `wp posts` table to grow without bound, leading to degraded database performance.

An issue exists where missing rate limiting allows unauthenticated attackers to flood password reset emails. This is achieved by aliasing the `sendPasswordResetEmail` mutation, enabling an attacker to send a single HTTP request containing multiple aliases. This technique bypasses the `batch limit`, which can exhaust the mail provider quota and cause repeated rotation of reset keys, effectively blocking legitimate password recovery processes.

An authorization flaw exists in the `createComment` mutation. This allows unauthenticated users to bypass post status checks and add comments to non-public posts, including those that are draft, private, trashed, or password-protected. This can lead to the enumeration of post IDs, the leaking of hidden titles through moderator notifications, and the ability to backdate comments or mark them as pingbacks.