Quick answers
- Is CVE-2021-47959 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2021-47959 being exploited in the wild.
- How severe is CVE-2021-47959?
- High severity, with a CVSS score of 7.5, published 15 May 2026.
- Which products and versions are affected?
- WPGraphQL <= 1.3.5.
- Is there a fix for CVE-2021-47959?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2021-47959 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2021-47959?
- Check whether you run WPGraphQL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A Denial of Service (DoS) vulnerability exists in WPGraphQL versions up to and including 1.3.5 due to improper resource allocation limits (CWE-770). The plugin fails to sufficiently throttle or validate batched GraphQL queries containing highly duplicated fields. An unauthenticated remote attacker can exploit this by sending a POST request to the GraphQL endpoint with an amplified payload. This triggers excessive resource consumption, leading to server out-of-memory (OOM) conditions and MySQL connection exhaustion. A proof-of-concept exploit is publicly available.
Affected products
- WPGraphQL WPGraphQL <= 1.3.5
Timeline
- 2021-04-12: other: Vulnerability discovered
- 2021-04-27: disclosed: Exploit published on Exploit-DB
- 2026-05-15: advisory: NVD/VulnCheck advisory published