Junglewise Threat Intelligence

CVE-2021-47959: WPGraphQL WordPress plugin denial of service via batched queries

CVE-2021-47959 · Severity: high · CVSS 7.5 · Published 2026-05-15

Executive brief

WPGraphQL is a WordPress plugin that provides an API for developers to fetch website content. A vulnerability in version 1.3.5 and earlier allows an attacker to crash the website or make it unresponsive by sending specially crafted, repetitive data requests. This can lead to a total service outage, preventing legitimate users from accessing the site and potentially causing server memory exhaustion.

Technical details

A Denial of Service (DoS) vulnerability exists in WPGraphQL versions up to and including 1.3.5 due to improper resource allocation limits (CWE-770). The plugin fails to sufficiently throttle or validate batched GraphQL queries containing highly duplicated fields. An unauthenticated remote attacker can exploit this by sending a POST request to the GraphQL endpoint with an amplified payload. This triggers excessive resource consumption, leading to server out-of-memory (OOM) conditions and MySQL connection exhaustion. A proof-of-concept exploit is publicly available.

Affected products

  • WPGraphQL WPGraphQL <= 1.3.5

Timeline

  • 2021-04-12: other: Vulnerability discovered
  • 2021-04-27: disclosed: Exploit published on Exploit-DB
  • 2026-05-15: advisory: NVD/VulnCheck advisory published

References

Related threats