Missing Authorization in WPGraphQL Smart Cache - #VU150209
Published: September 16, 2026
Vulnerability identifier: #VU150209
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a later caller to execute attacker-controlled GraphQL operations with that caller's privileges.
The vulnerability exists due to missing authorization and insufficient verification of data authenticity in the automatic persisted query registration path when processing requests containing both a query and a query ID. A remote attacker can submit a query and an arbitrary query ID alias to cause a later caller to execute attacker-controlled GraphQL operations with that caller's privileges.
Exploitation requires a later request to execute the claimed alias.
Affected software
WPGraphQL Smart Cache
Remediation
Install security update from vendor's website.
WPGraphQL Smart Cache - update to 2.3.2