CVE-2026-119701 Details

A missing rate limiting vulnerability has been identified in WPGraphQL versions prior to 2.24.1. This vulnerability allows unauthenticated attackers to abuse the sendPasswordResetEmail mutation by aliasing it, effectively flooding the target with password reset emails. Attackers can bypass the default batch limit by sending a single request with multiple aliases, exhausting the mail provider's quota and disrupting normal email delivery. Additionally, this exploitation can interfere with legitimate password recovery by repeatedly rotating reset keys, causing confusion for users trying to reset their passwords.

Users can update WPGraphQL to version 2.24.1 or later, which addresses this vulnerability by implementing a limit on the number of password reset emails that can be sent in a single request. After updating, requests that exceed this limit will receive an error message, and only the first email will be sent. For sites that require a higher limit, the new functionality can be enabled by adding a filter.