CVE-2026-119699 Details

A denial-of-service vulnerability has been identified in WPGraphQL Smart Cache versions prior to 2.3.3. This vulnerability allows unauthenticated attackers to consume resources uncontrollably by persisting an unlimited number of query documents through the Automatic Persisted Query (APQ) handler. Attackers can send distinct queries with matching SHA-256 queryId values, including batched operations, which are then stored as individual documents. This unbounded accumulation of documents in the wp_posts table can degrade database performance and lead to excessive growth of the posts table without any upper limit.

Users can update to WPGraphQL Smart Cache version 2.3.3 or later, which introduces a limit on the number of automatically saved query documents. After updating, the wp_posts table will converge to the new limit as traffic arrives, or documents can be purged manually using the 'wp graphql smart-cache documents audit' command.