CVE-2026-119701mediumCWE-770

CVE-2026-119701: medium-severity vulnerability in WPGraphQL

WPGraphQL before 2.24.1 Email Flooding via Aliased sendPasswordResetEmail Mutations

Published

Follow this CVE+ Monitor WPGraphQL

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.9epss 0.6%
WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to flood password reset emails by aliasing the sendPasswordResetEmail mutation. Attackers can send one HTTP request with many aliases, bypassing batch_limit, to exhaust mail provider quota and repeatedly rotate reset keys, blocking legitimate password recovery.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Affected products
WPGraphQL · WPGraphQL
Related CVEs — WPGraphQL

In the same product, most dangerous first.

CVE-2023-23684MEDIUMWordPress WPGraphQL Plugin <= 1.14.5 is vulnerable to Server Side Request Forgery (SSRF)EPSS 0.4%CVE-2026-119700MEDIUMWPGraphQL before 2.24.2 Object Existence Disclosure via Media and Comment MutationsEPSS 0.4%CVE-2026-119702MEDIUMWPGraphQL before 2.24.1 Missing Authorization via createComment MutationEPSS 0.4%CVE-2026-40762HIGHWordPress WPGraphQL plugin < 2.11.1 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-109703MEDIUMWordPress WPGraphQL plugin <= 2.23.1 - Sensitive Data Exposure vulnerabilityEPSS 0.2%CVE-2025-68604MEDIUMWordPress WPGraphQL plugin <= 2.5.3 - Cross Site Request Forgery (CSRF) vulnerabilityEPSS 0.1%