SB2026091651 - Missing Authorization in WPGraphQL Smart Cache

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026091651

SB2026091651 - Missing Authorization in WPGraphQL Smart Cache

Published: September 16, 2026

Security Bulletin ID SB2026091651
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a later caller to execute attacker-controlled GraphQL operations with that caller's privileges.

The vulnerability exists due to missing authorization and insufficient verification of data authenticity in the automatic persisted query registration path when processing requests containing both a query and a query ID. A remote attacker can submit a query and an arbitrary query ID alias to cause a later caller to execute attacker-controlled GraphQL operations with that caller's privileges.

Exploitation requires a later request to execute the claimed alias.


Remediation

Install update from vendor's website.

References