---
id: CVE-2026-119699
title: WPGraphQL Smart Cache before 2.3.3 Unbounded Persisted Query Storage DoS
summary: >-
  WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource
  consumption vulnerability that allows unauthenticated attackers to persist
  unlimited query documents via the Automatic Persisted Query handler. Attackers
  can send disti…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
cvssSource: cna
cwe:
  - CWE-770
vendor: WPGraphQL
product: WPGraphQL Smart Cache
affected:
  - smart_cache < 2.3.3
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-04T22:48:06.077643Z'
published: '2026-10-30'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T22:48:17.469Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119699'
references:
  - url: >-
      https://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-5p5r-f66g-r4vp
    label: GitHub Security Advisory (GHSA-5p5r-f66g-r4vp)
  - url: >-
      https://github.com/wp-graphql/wp-graphql/commit/80c021c42f4d4969e1b41760a08b4faf3c544a9e
  - url: >-
      https://github.com/wp-graphql/wp-graphql/blob/wp-graphql-smart-cache/v2.3.2/plugins/wp-graphql-smart-cache/src/Document.php
  - url: >-
      https://github.com/wp-graphql/wp-graphql/releases/tag/wp-graphql-smart-cache%2Fv2.3.3
    label: WPGraphQL Smart Cache wp-graphql-smart-cache/v2.3.3 Release Notes
  - url: 'https://github.com/wp-graphql/wp-graphql'
  - url: >-
      https://www.vulncheck.com/advisories/wpgraphql-smart-cache-before-2.3.3-unbounded-persisted-query-storage-dos
    label: >-
      VulnCheck Advisory: WPGraphQL Smart Cache before 2.3.3 Unbounded Persisted
      Query Storage DoS
tags:
  - cve.org
epss: 0.00454
epssPercentile: 0.39522
ingestedAt: '2026-11-05T21:36:00.660Z'
---

## Overview

WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to persist unlimited query documents via the Automatic Persisted Query handler. Attackers can send distinct queries with matching SHA-256 queryId values, including batched operations, to grow the wp_posts table without bound and degrade database performance.

## Affected

- `smart_cache < 2.3.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.