7.5
HighCVSS 3.1 · from VulnCheck
CVE-2021-47959
WordPress Plugin WPGraphQL 1.3.5 Denial of Service
WPGraphQL · Allocation without limits · CWE-770AffectedWPGraphQL
FixNo fix listed yet.
PublishedMay 15, 18:36 · VulnCheck
ScoredMay 15 · 7.5 · VulnCheck
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:11 UTC
What we know
No known exploitation. CISA KEV, checked 22:11 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
A successful attack can take the service down. CVSS impact.
Description
WordPress Plugin WPGraphQL 1.3.5 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server resources by sending batched GraphQL queries with duplicated fields. Attackers can send POST requests to the GraphQL endpoint with amplified field duplication payloads to trigger server out-of-memory conditions and MySQL connection errors.
From VulnCheck
Affected and fixed versions
ProductAffectedFixed inWPGraphQL1.3.5–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known