rootpwn

medium · CVSS v3 6.5 · EPSS 0.00136

CVE-2026-92099

The WPGraphQL Smart Cache WordPress plugin before 2.3.2 allows unauthenticated users to publish arbitrary GraphQL queries and claim aliases

Overview

The WPGraphQL Smart Cache WordPress plugin before 2.3.2 allows unauthenticated users to publish arbitrary GraphQL queries and claim aliases without authorization. This flaw lets attackers inject or modify persisted queries that the site’s frontend will later execute. It can lead to data leakage, query tampering, or denial of service.

Description

The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authorisation or validate a caller-supplied query identifier before storing a persisted query from a request, allowing unauthenticated users to publish arbitrary query documents and claim query aliases before a site's own frontend registers them.

Impact

Confidentiality: attackers can expose sensitive data via crafted queries. Integrity: malicious queries can alter application behavior. Availability: repeated abuse may exhaust resources. Site administrators and developers are directly impacted.

Remediation

Upgrade WPGraphQL Smart Cache to version 2.3.2 or later. If upgrade is not possible, disable persisted query publishing or enforce authentication on the endpoint. Validate query identifiers before storing and ensure only trusted users can register aliases.

Risk context

The vulnerability has a medium CVSS score of 6.5 and a very low EPSS of 0.00136, indicating low likelihood of exploitation but still worth patching promptly.

Affected products

  • WPGraphQL Smart Cache
  • WordPress

Scores

Severity
medium
CVSS v2
5
CVSS v3
6.5
CVSS v4
—
EPSS
0.00136

WordPress GraphQL Plugin Unauthenticated Persistence Authorization Medium

← All CVEs

Related CVEs

medium

CVE-2026-12042

The WP2Social Auto Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) within its administrative settings. This vulnerability exists in all versions up to 2.4.12 due to inadequate input sanitization and output escaping of user-provided data.

View analysis

medium

CVE-2026-15660

The SEO Booster plugin for WordPress versions up to 7.4.7 suffers from a missing authorization check that allows any authenticated user with Subscriber role or higher to overwrite critical options. This can disrupt the Google Search Console integration and inject attacker‑supplied data into site options. The flaw is exploitable via a crafted /wp-admin/ URL that triggers the vulnerable handle_oauth_callback function.

View analysis

medium

CVE-2026-15760

The Divi Essential plugin for WordPress contains a vulnerability in its AJAX handlers that allows authenticated users to access sensitive database information. Due to missing authorization checks and bypassable security tokens, any user with Subscriber-level access can enumerate and read arbitrary database tables. This exposure includes critical data such as user credentials, session tokens, and site configuration settings.

View analysis

medium

CVE-2025-15698

The Business Name Generator plugin for WordPress, up to version 1.3, contains a vulnerability where configuration settings are not properly sanitized or escaped. This allows high-privileged users to inject malicious scripts into the application's database, which are then executed when the settings page is viewed.

View analysis