WPGraphQL before 2.24.1 Email Flooding via Aliased sendPasswordResetEmail Mutations

WPGraphQL · Allocation without limits · CWE-770

AffectedWPGraphQL

FixUpdate to 2.24.1 or newer

PublishedOct 30, 15:16 · VulnCheck

ScoredOct 30 · 5.3 · VulnCheck

Exploit code publicNone known · checked 21:18 UTC

ExploitedNone known · CISA KEV checked 22:11 UTC

What we know

No known exploitation. CISA KEV, checked 22:11 UTC.

No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.

An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.

Description

WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to flood password reset emails by aliasing the sendPasswordResetEmail mutation. Attackers can send one HTTP request with many aliases, bypassing batch_limit, to exhaust mail provider quota and repeatedly rotate reset keys, blocking legitimate password recovery.

From VulnCheck

Affected and fixed versions

ProductAffectedFixed inWPGraphQLbefore 2.24.12.24.1

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

GitHub Security Advisory (GHSA-f5f8-v768-93c8) · github.comvendor advisory github.com/wp-graphql/wp-graphql/commit/760db555e3e60fbd86c1d96f1689bacfc9265592 · github.compatch github.com/wp-graphql/wp-graphql/blob/wp-graphql/v2.24.0/plugins/wp-graphql/src/Mutation/SendPasswordResetEmail.php · github.comtechnical description WPGraphQL wp-graphql/v2.24.1 Release Notes · github.comrelease notes github.com/wp-graphql/wp-graphql · github.comproduct VulnCheck Advisory: WPGraphQL before 2.24.1 Email Flooding via Aliased sendPasswordResetEmail Mutations · vulncheck.comthird party advisory

Other CVEs in WPGraphQL

All 3 →

6.5WPGraphQL before 2.24.1 Missing Authorization via createComment Mutation · CVE-2026-119702Oct 30 5.3WPGraphQL before 2.24.2 Object Existence Disclosure via Media and Comment Mutations · CVE-2026-119700Oct 30 7.5WordPress Plugin WPGraphQL 1.3.5 Denial of Service · CVE-2021-47959May 15