CVE-2026-119699 WPGraphQL Smart Cache before 2.3.3 Unbounded Persisted Query Storage DoS

Medium 6.9 Published 30 Oct 2026 Updated 4 Nov 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-119699?

CVE-2026-119699 is a medium-severity vulnerability in WPGraphQL Smart Cache, published on 30 Oct 2026.

Official description

WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to persist unlimited query documents via the Automatic Persisted Query handler. Attackers can send distinct queries with matching SHA-256 queryId values, including batched operations, to grow the wp_posts table without bound and degrade database performance.

Weakness: CWE-770

Which versions are affected by CVE-2026-119699?

How do I fix CVE-2026-119699?

No fix has been published for CVE-2026-119699 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-119699 being exploited?

There is no known exploitation of CVE-2026-119699 in the wild and no public exploit code.

Sources

Also known as GHSA-5p5r-f66g-r4vp, GHSA-v637-6536-jqxc.