# CVE-2026-119701: WPGraphQL missing rate limiting in password reset email mutation

Source: https://junglewise.ai/threats/cve-2026-119701-wpgraphql-before-2-24-1-contains-a-missing-rate-limiting  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-119701 · Severity: medium · CVSS 5.3 · Published 2026-10-30

WPGraphQL is a GraphQL API plugin for WordPress that allows developers to interact with WordPress data via GraphQL queries. An attacker can exploit missing rate limiting on the password reset email function to send hundreds of reset emails by aliasing mutations in a single request, exhausting email provider quotas and rotating password reset keys to prevent legitimate users from recovering their accounts.

Technologies: [WPGraphQL](https://junglewise.ai/threats/technologies/wpgraphql). Vendors: [WPGraphQL](https://junglewise.ai/threats/vendors/wpgraphql).

## Quick answers

**Is CVE-2026-119701 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-119701 being exploited in the wild.

**How severe is CVE-2026-119701?** Medium severity, with a CVSS score of 5.3, published 30 October 2026.

**Which products and versions are affected?** WPGraphQL before 2.24.1.

**Is there a fix for CVE-2026-119701?** Yes: fixed in 2.24.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-119701 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-119701?** Check whether you run WPGraphQL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.24.1

## Technical details

The sendPasswordResetEmail mutation lacks per-request rate limiting, allowing an attacker to bypass batch_limit restrictions by using GraphQL query aliases to trigger multiple mutations in one HTTP request. An unauthenticated attacker can repeatedly call get_password_reset_key() and wp_mail(), exhausting mail provider limits and rotating reset keys to block account recovery. The vulnerability requires network access but no authentication or user interaction.

## Affected products

- WPGraphQL WPGraphQL before 2.24.1

## Timeline

- 2026-10-30: disclosed

## References

- [https://github.com/wp-graphql/wp-graphql](https://github.com/wp-graphql/wp-graphql)
- [https://github.com/wp-graphql/wp-graphql/blob/wp-graphql/v2.24.0/plugins/wp-graphql/src/Mutation/SendPasswordResetEmail.php](https://github.com/wp-graphql/wp-graphql/blob/wp-graphql/v2.24.0/plugins/wp-graphql/src/Mutation/SendPasswordResetEmail.php)

## Related threats

- [WPGraphQL createComment mutation missing authorization](https://junglewise.ai/threats/cve-2026-119702-wpgraphql-before-2-24-1-contains-a-missing-authorization)
- [WPGraphQL authorization bypass in updatePost mutation](https://junglewise.ai/threats/cve-2026-88974-wpgraphql-authorization-bypass-in-updatepost-mutation)
- [WPGraphQL user enumeration in SendPasswordResetEmail mutation](https://junglewise.ai/threats/cve-2026-54768-wpgraphql-user-enumeration-in-sendpasswordresetemail-mutation)
- [WPGraphQL SQL injection in WordPress plugin](https://junglewise.ai/threats/cve-2026-40762-wpgraphql-sql-injection-in-wordpress-plugin)
- [WPGraphQL WordPress plugin denial of service via batched queries](https://junglewise.ai/threats/cve-2021-47959-wpgraphql-wordpress-plugin-denial-of-service-via-batched-queries)