CVE-2021-47959 WordPress Plugin WPGraphQL 1.3.5 Denial of Service
Unauthenticated attackers can cause denial of service in WPGraphQL by sending batched queries with duplicated fields, exhausting server resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-47959?
CVE-2021-47959 is a high-severity denial of service vulnerability in WPGraphQL, published on 15 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
WordPress Plugin WPGraphQL 1.3.5 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server resources by sending batched GraphQL queries with duplicated fields. Attackers can send POST requests to the GraphQL endpoint with amplified field duplication payloads to trigger server out-of-memory conditions and MySQL connection errors.
Weakness: CWE-770
Which versions are affected by CVE-2021-47959?
How do I fix CVE-2021-47959?
No fix has been published for CVE-2021-47959 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-47959 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-47959 exists.
Sources
Also known as GHSA-3mgf-xgf9-2wg2.