CVE-2026-119699

Medium

Description

WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to persist unlimited query documents via the Automatic Persisted Query handler. Attackers can send distinct queries with matching SHA-256 queryId values, including batched operations, to grow the wp_posts table without bound and degrade database performance.

SeverityMedium

CVSS5.3

Exploit probability—

ProductWPGraphQL Smart Cache

PublishedOct 30, 2026

First seenNov 4, 2026

Weakness typeCWE-770Allocation of resources without limits

How to fix

Update

WPGraphQL WPGraphQL Smart Cache2.3.3 or later

Patches

github.com/wp-graphql/wp-graphql/commit/80c021c42f4d4969e1b41760a08b4faf3c544a9e

Vendor advisories

Affected products

Product	Affected versions	Fixed in
WPGraphQL WPGraphQL Smart Cache	v < 2.3.3	2.3.3

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.