WPGraphQL Smart Cache EUVD-2026-114104

No special conditions beyond a reachable WPGraphQL GraphQL endpoint running Smart Cache 2.3.2 or earlier in its default configuration: Automatic Persisted Query saving defaults to 'anyone, including logged-out visitors', and garbage collection is opt-in, defaults to off, and prunes by age rather than by count - so on a default install nothing bounds or reclaims persisted documents. Limiting factors that reduce realistic risk: impact is confined to database bloat and query slowdown (no data exposure, no code execution, no scope change); versions 2.3.3+ cap documents at 5000 by default; and administrators who set the new mode to 'logged in users only' or 'nobody' remove the anonymous write path (note that on WPGraphQL core 2.5.4+, 'logged in users only' requires token auth such as JWT/application password or an X-WP-Nonce, not a bare browser cookie). The advisory states there is no workaround that keeps the endpoint open - enabling age-based garbage collection slows but does not bound growth - so updating to 2.3.3 is the only complete fix.

Signals are consistent and point to a genuine but bounded availability issue rather than a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the write path is trivially reachable - remote, low-complexity, unauthenticated, no user interaction - which matches the advisory's statement that Automatic Persisted Queries are open to anyone who can reach the endpoint in the default configuration. However, impact is limited to VA:L with VC:N/VI:N/VA (no confidentiality or integrity effect and no scope change): the advisory explicitly states no data is exposed and a caller cannot run anything they could not already run, so this is uncontrolled resource consumption (CWE-770) that bloats wp_posts and degrades database performance, not code execution or a full service outage. The vuln.today Decision label is 'this_month' (not act_now/emergency), aligning with the 6.9 medium base score. Key decision data is MISSING: no EPSS exploitation-probability score is provided, this CVE is NOT listed in CISA KEV, and no verified public exploit code is present in the inputs - only a VulnCheck advisory reference and the reporter's own measurement (~100 documents in 1.6 seconds from one thread). Net: prioritize patching within a normal cycle (confirmed fix exists), treating it as an easy-to-trigger, moderate-impact DoS/resource-exhaustion flaw rather than a critical breach risk. The ease of triggering (PR:N/AC:L) is the main argument for not deferring indefinitely, especially on managed hosts with hard database-size caps.

An unauthenticated remote attacker repeatedly POSTs distinct GraphQL queries, each paired with its SHA-256 queryId, to the public WPGraphQL endpoint via the Automatic Persisted Query handler, optionally batching many operations into a single request so each operation persists its own wp_posts row. Because garbage collection is off by default and prunes by age rather than count, nothing reclaims these rows, so the table grows without bound - the reporter measured roughly 100 documents in 1.6 seconds from a single thread - inflating database storage and slowing any query scoped to wp_posts. No public exploit code is identified at time of analysis, though the mechanism is simple and documented in the vendor advisory.