Executive brief
WPGraphQL Smart Cache is a WordPress plugin that optimizes GraphQL query performance. The plugin fails to validate requests before storing persisted queries, allowing unauthenticated attackers to register malicious queries and claim query aliases that legitimate frontend code expects to use, potentially leading to query injection attacks or denial of service.
Technical details
The plugin lacks authorization checks and query identifier validation when registering persisted queries, allowing unauthenticated users to submit arbitrary GraphQL query documents. An attacker can preemptively claim query aliases before legitimate frontend queries register them, resulting in query injection or collision attacks. The vulnerability is fixed in version 2.3.2.
Affected products
- WPGraphQL Smart Cache WPGraphQL Smart Cache before 2.3.2
Timeline
- 2026-09-17: disclosed
- 2026-09-19: patched: version 2.3.2 released