PT-2026-133633

CVE-2026-119699

Published

2026-10-30

Updated

2026-10-30

Description by

CVSS 4.0

6.9

Medium

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions WPGraphQL Smart Cache versions prior to 2.3.3

Description An uncontrolled resource consumption issue exists within the Automatic Persisted Query handler. Unauthenticated attackers can persist unlimited query documents by sending distinct queries that share matching SHA-256 queryId values, including batched operations. This process causes the wp posts table to grow without bound, leading to degraded database performance.

Recommendations Update to version 2.3.3 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-770: Allocation of Resources Without Limits or Throttling

Related identifiers

CVE-2026-119699