CVE-2026-119701

Name of the Vulnerable Software and Affected Versions WPGraphQL versions prior to 2.24.1

Description An issue exists where missing rate limiting allows unauthenticated attackers to flood password reset emails. This is achieved by aliasing the sendPasswordResetEmail mutation, enabling an attacker to send a single HTTP request containing multiple aliases. This technique bypasses the batch limit, which can exhaust the mail provider quota and cause repeated rotation of reset keys, effectively blocking legitimate password recovery processes.

Recommendations Update to version 2.24.1 or later.