CVE-2026-119701 in WPGraphQL Plugin
Summary
by MITRE • 10/30/2026
WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to flood password reset emails by aliasing the sendPasswordResetEmail mutation. Attackers can send one HTTP request with many aliases, bypassing batch_limit, to exhaust mail provider quota and repeatedly rotate reset keys, blocking legitimate password recovery.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in WPGraphQL prior to version 2.24.1 represents a critical failure in input validation and resource management mechanisms within the WordPress GraphQL API implementation. Specifically, this flaw resides in the sendPasswordResetEmail mutation, which is designed to facilitate legitimate password recovery for users who have forgotten their credentials. The core technical deficiency lies in the absence of adequate rate limiting controls that apply effectively when multiple email aliases are processed within a single HTTP request. In standard web application security practices, rate limiting is essential to prevent abuse of authentication-related endpoints by restricting the frequency with which these actions can be performed. However, in this specific implementation, attackers were able to circumvent existing batch limits by structuring their requests to include numerous distinct email aliases or variations within one payload. This architectural oversight allowed malicious actors to trigger a disproportionate number of password reset operations relative to the single API call made, effectively bypassing safeguards intended to throttle such activity and maintain system stability.
From an operational perspective, this vulnerability enables unauthenticated attackers to execute denial-of-service attacks against both the target WordPress site and its associated email infrastructure. By flooding the mail provider with a high volume of password reset emails in rapid succession, attackers can exhaust the daily or monthly sending quotas imposed by third-party SMTP services such as SendGrid, Amazon SES, or Mailgun. This exhaustion leads to temporary suspension of email delivery capabilities for all users on the platform, disrupting critical communications beyond just authentication flows. Furthermore, the ability to repeatedly rotate reset keys without restriction poses a significant security risk to user accounts. Legitimate users attempting to recover their passwords may find themselves locked out because an attacker has continuously generated new reset tokens, potentially invalidating or confusing the recovery process for genuine owners of the affected accounts. This not only degrades service availability but also undermines trust in the authentication system's reliability and integrity.
This vulnerability aligns with CWE-770: Allocation of Resources Without Limits or Throttling, as it involves the uncontrolled consumption of external resources due to insufficient rate limiting controls. Additionally, from a threat modeling perspective using the MITRE ATT&CK framework, this behavior corresponds to T1498: Network Denial of Service, specifically through resource exhaustion techniques that target application-level services rather than network bandwidth. The exploitation vector is classified under Unauthenticated Access (T1078) combined with Abuse of Functionality (T1562), as the attacker leverages a legitimate feature for malicious purposes without requiring valid credentials. Understanding these classifications helps security teams contextualize the severity and prioritize remediation efforts within broader vulnerability management programs, ensuring that similar logic flaws in other API endpoints are also reviewed and hardened against resource exhaustion attacks.
To mitigate this risk, organizations running WPGraphQL versions earlier than 2.24.1 must upgrade to the patched version immediately where rate limiting has been properly implemented for the sendPasswordResetEmail mutation. The fix ensures that even if multiple aliases are provided in a single request, the system enforces strict limits on the number of emails sent per user or IP address within a defined time window. In addition to upgrading software, administrators should implement additional defensive layers such as CAPTCHA challenges on password reset forms for unauthenticated users, which adds friction against automated scripting attacks. Monitoring email provider dashboards for unusual spikes in outbound traffic can also serve as an early warning system for ongoing exploitation attempts. Furthermore, configuring web application firewalls with rules that detect and block requests containing unusually large arrays of email addresses or high-frequency mutation calls provides a robust defense-in-depth strategy to protect WordPress installations from this specific abuse pattern until all instances are fully updated.