Vulnerability · Published Oct 30, 2026 · Assigned by VulnCheck

CVE-2026-119699WPGraphQL Smart Cache before 2.3.3 Unbounded Persisted Query Storage DoS

Medium 5.3

In plain English

A medium-severity resource allocation without limits in WPGraphQL Smart Cache from WPGraphQL. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.5%top 60.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to persist unlimited query documents via the Automatic Persisted Query handler. Attackers can send distinct queries with matching SHA-256 queryId values, including batched operations, to grow the wp_posts table without bound and degrade database performance.

Affected products (as reported)

Vendor	Product	Versions
WPGraphQL	WPGraphQL Smart Cache	0 – before 2.3.3

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

GitHub Security Advisory (GHSA-5p5r-f66g-r4vp) vendor-advisory
https://github.com/wp-graphql/wp-graphql/commit/80c021c42f4d4969e1b41760a08b4faf3c544a9e patch
https://github.com/wp-graphql/wp-graphql/blob/wp-graphql-smart-cache/v2.3.2/plugins/wp-graphql-smart-cache/src/Document.php technical-description
WPGraphQL Smart Cache wp-graphql-smart-cache/v2.3.3 Release Notes release-notes
https://github.com/wp-graphql/wp-graphql product
VulnCheck Advisory: WPGraphQL Smart Cache before 2.3.3 Unbounded Persisted Query Storage DoS third-party-advisory