Vulnerability · Published Oct 30, 2026 · Assigned by VulnCheck

CVE-2026-119701WPGraphQL before 2.24.1 Email Flooding via Aliased sendPasswordResetEmail Mutations

Medium 5.3

In plain English

A medium-severity resource allocation without limits in WPGraphQL from WPGraphQL. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.6%top 51.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to flood password reset emails by aliasing the sendPasswordResetEmail mutation. Attackers can send one HTTP request with many aliases, bypassing batch_limit, to exhaust mail provider quota and repeatedly rotate reset keys, blocking legitimate password recovery.

Affected products (as reported)

Vendor	Product	Versions
WPGraphQL	WPGraphQL	0 – before 2.24.1

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

GitHub Security Advisory (GHSA-f5f8-v768-93c8) vendor-advisory
https://github.com/wp-graphql/wp-graphql/commit/760db555e3e60fbd86c1d96f1689bacfc9265592 patch
https://github.com/wp-graphql/wp-graphql/blob/wp-graphql/v2.24.0/plugins/wp-graphql/src/Mutation/SendPasswordResetEmail.php technical-description
WPGraphQL wp-graphql/v2.24.1 Release Notes release-notes
https://github.com/wp-graphql/wp-graphql product
VulnCheck Advisory: WPGraphQL before 2.24.1 Email Flooding via Aliased sendPasswordResetEmail Mutations third-party-advisory