Wpgraphql Smart Cache
Monthly
Unauthenticated attackers can publish arbitrary persisted query documents and claim (squat) query aliases on WordPress sites running the WPGraphQL Smart Cache plugin before 2.3.2, because the plugin neither requires authorization for the storage request nor validates the caller-supplied query identifier. WPScan reports that publicly available exploit code exists, though there is no confirmed active exploitation (not in CISA KEV); scoring is CVSS 3.1 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) and the independent assessment characterizes this as a moderate, integrity-focused risk. Practical impact is bounded by whether the site actually depends on persisted queries and aliases and by a first-claim race - the attacker must register an alias before the site's own frontend does - and WPGraphQL's own access controls still govern what any stored query can return, so confidentiality loss is not demonstrated.
Unauthenticated attackers can publish arbitrary persisted query documents and claim (squat) query aliases on WordPress sites running the WPGraphQL Smart Cache plugin before 2.3.2, because the plugin neither requires authorization for the storage request nor validates the caller-supplied query identifier. WPScan reports that publicly available exploit code exists, though there is no confirmed active exploitation (not in CISA KEV); scoring is CVSS 3.1 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) and the independent assessment characterizes this as a moderate, integrity-focused risk. Practical impact is bounded by whether the site actually depends on persisted queries and aliases and by a first-claim race - the attacker must register an alias before the site's own frontend does - and WPGraphQL's own access controls still govern what any stored query can return, so confidentiality loss is not demonstrated.