WPGraphQL EUVD-2026-114106

No special conditions for the mail-exhaustion case - remote unauthenticated exploitation against default configurations of WPGraphQL 2.24.0 and earlier, because the per-request batch_limit (default 10) counts batched operations and never sees aliased field invocations inside a single operation. To deny recovery to a specific person, the attacker additionally needs that account's username or email address, which the advisory notes is public information on most sites. Limiting factors: the vulnerability requires the WPGraphQL plugin to be installed and its GraphQL endpoint reachable; impact is confined to email delivery and reset-key rotation (no data read or modified). Edge mitigations do not fully help - lowering the batch limit is ineffective because aliases are not batch entries, and WAF/reverse-proxy rate limiting caps request count but not the work a single request performs; the vendor states updating to 2.24.1 is the fix.

This is a genuine but bounded availability issue, not a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitation against default configurations, and the only impact metric set is VA:L - no confidentiality or integrity effect, limited availability impact confined to email delivery and password recovery. The vendor advisory corroborates the mechanism in detail (alias-based bypass of the batch_limit counter) and states the reporter measured ~1000 emails in 5 seconds from one anonymous request, so the flaw is real and trivially triggerable. However, the input provides no EPSS score, no CISA KEV listing, and no public exploit reference - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a moderate-severity DoS. Net: a real, patch-this-month priority for sites running WPGraphQL, driven by ease of exploitation rather than impact severity, but it is a high-CVSS-adjacent availability nuisance rather than a critical compromise vector - no data is exposed or modified beyond the target account's own reset key.

An unauthenticated attacker sends a single HTTP POST to the WPGraphQL endpoint containing one operation that aliases the sendPasswordResetEmail mutation hundreds of times (and can stack this across up to 10 batched operations), causing the site to fire a password-reset email per alias. This either exhausts the host's or mail provider's sending quota so all transactional email (orders, notifications, admin alerts, resets) stops, or - supplying a known username/email - continuously rotates a specific user's reset key faster than they can use it, denying that person account recovery. No public exploit code is identified in the provided data, but the vendor reports the behavior was reproduced at roughly 1000 emails in 5 seconds.