CVE-2026-119701mediumCWE-770

CVE-2026-119701: fallo de gravedad media en WPGraphQL

WPGraphQL before 2.24.1 Email Flooding via Aliased sendPasswordResetEmail Mutations

Publicada el

Seguir esta CVE+ Monitorear WPGraphQL

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.9epss 0.6%
WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to flood password reset emails by aliasing the sendPasswordResetEmail mutation. Attackers can send one HTTP request with many aliases, bypassing batch_limit, to exhaust mail provider quota and repeatedly rotate reset keys, blocking legitimate password recovery.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Productos afectados
WPGraphQL · WPGraphQL
CVEs relacionadas — WPGraphQL

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-23684MEDIUMWordPress WPGraphQL Plugin <= 1.14.5 is vulnerable to Server Side Request Forgery (SSRF)EPSS 0.4%CVE-2026-119700MEDIUMWPGraphQL before 2.24.2 Object Existence Disclosure via Media and Comment MutationsEPSS 0.4%CVE-2026-119702MEDIUMWPGraphQL before 2.24.1 Missing Authorization via createComment MutationEPSS 0.4%CVE-2026-40762HIGHWordPress WPGraphQL plugin < 2.11.1 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-109703MEDIUMWordPress WPGraphQL plugin <= 2.23.1 - Sensitive Data Exposure vulnerabilityEPSS 0.2%CVE-2025-68604MEDIUMWordPress WPGraphQL plugin <= 2.5.3 - Cross Site Request Forgery (CSRF) vulnerabilityEPSS 0.1%