PT-2026-133635

CVE-2026-119701

·

Published

2026-10-30

·

Updated

2026-10-30

Description by

CVSS 3.1
5.3
Medium
MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to flood password reset emails by aliasing the sendPasswordResetEmail mutation. Attackers can send one HTTP request with many aliases, bypassing batch limit, to exhaust mail provider quota and repeatedly rotate reset keys, blocking legitimate password recovery.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-770: Allocation of Resources Without Limits or Throttling
Related identifiers
CVE-2026-119701
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com