WPGraphQL Smart Cache before 2.3.3 Unbounded Persisted Query Storage DoS
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 2.3.3
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
WPGraphQL Smart Cache, a caching plugin for WordPress sites using the WPGraphQL extension, is affected by this vulnerability. An unauthenticated attacker can cause the site's database to grow without limit by storing large numbers of queries, which slows database performance and can cause a denial of service.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to persist unlimited query documents via the Automatic Persisted Query handler. Attackers can send distinct queries with matching SHA-256 queryId values, including batched operations, to grow the wp_posts table without bound and degrade database performance.
Timeline
- CVE published
- Record last updated
- First seen by cve.now
Affected versions
- WPGraphQL WPGraphQL Smart Cache
fixed in 2.3.3