Executive brief
WPGraphQL is a WordPress plugin that provides an API for developers to fetch website content. A vulnerability in version 1.3.5 and earlier allows an attacker to crash the website or make it unresponsive by sending specially crafted, repetitive data requests. This can lead to a total service outage, preventing legitimate users from accessing the site and potentially causing server memory exhaustion.
Technical details
A Denial of Service (DoS) vulnerability exists in WPGraphQL versions up to and including 1.3.5 due to improper resource allocation limits (CWE-770). The plugin fails to sufficiently throttle or validate batched GraphQL queries containing highly duplicated fields. An unauthenticated remote attacker can exploit this by sending a POST request to the GraphQL endpoint with an amplified payload. This triggers excessive resource consumption, leading to server out-of-memory (OOM) conditions and MySQL connection exhaustion. A proof-of-concept exploit is publicly available.
Affected products
- WPGraphQL WPGraphQL <= 1.3.5
Timeline
- 2021-04-12: other: Vulnerability discovered
- 2021-04-27: disclosed: Exploit published on Exploit-DB
- 2026-05-15: advisory: NVD/VulnCheck advisory published