CVE-2026-119699 in Smart Cache Plugin
Summary
by MITRE • 10/30/2026
WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to persist unlimited query documents via the Automatic Persisted Query handler. Attackers can send distinct queries with matching SHA-256 queryId values, including batched operations, to grow the wp_posts table without bound and degrade database performance.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in WPGraphQL Smart Cache prior to version 2.3.3 represents a critical uncontrolled resource consumption flaw rooted in the implementation of the Automatic Persisted Query feature. This mechanism is designed to optimize GraphQL query execution by storing frequently used queries and referencing them via their SHA-256 hash, known as the queryId. The core technical failure lies in the absence of adequate validation or rate limiting when handling these persisted queries from unauthenticated sources. Attackers can exploit this weakness by submitting distinct query documents that coincidentally produce identical SHA-256 hashes to existing entries or by generating new unique hashes without proper constraints on storage limits. This allows for the indefinite accumulation of records within the wp_posts database table, which serves as the underlying storage mechanism for these cached queries in WordPress environments.
From an operational perspective, this vulnerability leads to severe performance degradation and potential denial-of-service conditions. As attackers continuously send distinct queries with matching or new queryId values, including batched operations that can contain multiple requests per HTTP call, the database size expands without bound. This uncontrolled growth consumes significant disk space and memory resources while increasing latency for all database interactions. The strain on the database server can result in slow response times for legitimate users, increased CPU usage due to complex query processing, and ultimately a complete service outage if storage limits are reached or system stability is compromised. The ability to perform batched operations exacerbates this impact by allowing attackers to inject multiple malicious entries simultaneously, accelerating the resource exhaustion process significantly compared to single-query attacks.
This vulnerability aligns with CWE-400, which classifies uncontrolled resource consumption as a category of weakness where software does not properly control the allocation and maintenance of limited resources. In terms of offensive security frameworks, this exploit maps directly to MITRE ATT&CK technique T1496, Resource Hijacking, specifically under the sub-technique for Denial of Service via resource exhaustion. The attack vector is classified as Network-based with an Attack Complexity of Low, requiring no authentication and minimal specialized conditions, making it highly accessible to malicious actors seeking to disrupt web services or create leverage for further exploitation attempts against WordPress infrastructure.
Mitigation strategies must focus on immediate patching and architectural hardening. Administrators should upgrade WPGraphQL Smart Cache to version 2.3.3 or later, where the developers have implemented fixes to limit the number of persisted queries per user or globally and enforce stricter validation on query document sizes and frequencies. Additionally, implementing rate limiting at the web server or application firewall level can help mitigate bulk requests that attempt to exploit this flaw. Database monitoring should be enhanced to detect unusual growth patterns in the wp_posts table associated with GraphQL cache entries. For environments where upgrading is not immediately feasible, restricting access to the GraphQL endpoint via IP whitelisting for known clients and disabling automatic persisted query features if they are not strictly necessary can serve as effective temporary countermeasures against this specific attack vector.