CVE-2026-119701 WPGraphQL before 2.24.1 Email Flooding via Aliased sendPasswordResetEmail Mutations

Medium 6.9 Published 30 Oct 2026 Updated 30 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-119701?

CVE-2026-119701 is a medium-severity vulnerability in WPGraphQL, published on 30 Oct 2026.

Official description

WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to flood password reset emails by aliasing the sendPasswordResetEmail mutation. Attackers can send one HTTP request with many aliases, bypassing batch_limit, to exhaust mail provider quota and repeatedly rotate reset keys, blocking legitimate password recovery.

Weakness: CWE-770

Which versions are affected by CVE-2026-119701?

How do I fix CVE-2026-119701?

No fix has been published for CVE-2026-119701 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-119701 being exploited?

There is no known exploitation of CVE-2026-119701 in the wild and no public exploit code.

Sources

Also known as GHSA-f5f8-v768-93c8, GHSA-f8vm-v352-pm3p.