CVE-2026-92099

MediumCVSS 6.5

Published: 19/09/2026(UTC)Updated: 21/09/2026(UTC)Translated: 19/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

11th percentile - higher than 11% of all known CVEs

Summary

The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authorisation or validate a caller-supplied query identifier before storing a persisted query from a request. This allows unauthenticated users to publish arbitrary query documents and claim query aliases before a site's own frontend registers them.

Risk Assessment

Attackers can manipulate the query cache, potentially leading to cache poisoning, data leakage, or disruption of application functionality.

Recommendation

Update the WPGraphQL Smart Cache plugin to version 2.3.2 or later. Additionally, require authorization for persisted query storage operations.

Other vulnerabilities in WPGraphQL Smart Cache

CVE-2026-119699Medium
WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to persist unlimited query documents via the Automatic Persisted Query handler. An attacker can send distinct queries with matching SHA-256 queryId values, including batched operations, to grow the wp_posts table without bound and degrade database performance.

Original NVD description (English source)

The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authorisation or validate a caller-supplied query identifier before storing a persisted query from a request, allowing unauthenticated users to publish arbitrary query documents and claim query aliases before a site's own frontend registers them.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS