Description

The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authorisation or validate a caller-supplied query identifier before storing a persisted query from a request, allowing unauthenticated users to publish arbitrary query documents and claim query aliases before a site's own frontend registers them.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-19T07:16:33.583Z",
  "pubdate": "2026-09-19T07:16:33.583Z",
  "executiveSummary": "The WPGraphQL Smart Cache plugin is susceptible to an unauthorized persisted query storage vulnerability. This flaw stems from a lack of proper authorization checks and input validation when processing query identifiers.\nUnauthenticated remote attackers can leverage this vulnerability to inject arbitrary GraphQL query documents into the server-side cache. By supplying a user-defined query identifier, an attacker can claim query aliases before the legitimate frontend registers them.\nThis behavior results in a form of cache poisoning, potentially leading to unauthorized data exposure, denial of service regarding specific query functionality, or the manipulation of the GraphQL schema responses as seen by the application frontend.\nThe vulnerability affects WPGraphQL Smart Cache versions prior to 2.3.2. Because this does not require authentication, the risk level is critical for any WordPress installation utilizing persistent GraphQL queries, as it allows external entities to manipulate internal server-side caching states without prior credentials.",
  "technicalDetails": "The core of the vulnerability resides within the request handling logic responsible for persisted query registration. In the affected versions of WPGraphQL Smart Cache, the plugin provides an endpoint or mechanism that accepts a GraphQL query body associated with a specific query identifier (often referred to as a query ID or hash).\nThe root cause is twofold: a failure to implement mandatory authorization middleware on the endpoint handling the registration of persisted queries, and an absence of server-side validation for the provided query identifier. The application assumes that any incoming request to this endpoint is legitimate and authorized to define or overwrite persistent queries.\nAn attacker can initiate a POST request containing a malicious GraphQL query document. By specifying an arbitrary identifier in the request parameters, the attacker forces the plugin to map this identifier to the injected query document within the application's persistent cache. Because the system does not verify the requester's identity or cross-reference the identifier against an expected registry, the attacker can 'pre-register' identifiers.\nThe attack flow follows these steps: 1) The attacker identifies the endpoint responsible for saving persistent queries in the WPGraphQL Smart Cache plugin. 2) The attacker crafts a request containing a chosen, potentially sensitive or frequently used, query identifier. 3) The attacker submits this request to the plugin, effectively mapping the identifier to a malicious or probe-related GraphQL query. 4) When the legitimate application frontend attempts to register or execute that specific query identifier, the server-side cache returns the attacker's stored query instead of the intended one, or results in a collision that disrupts site operations.\nThis allows for several post-exploitation scenarios, including the retrieval of sensitive data through GraphQL introspection or query execution that the attacker would not normally have access to, or simply causing a Denial of Service (DoS) for legitimate frontend functionality by replacing critical cached queries with invalid or resource-intensive payloads.\nThe exposure is strictly network-based, reachable by any unauthenticated remote user capable of sending HTTP requests to the WordPress instance. Affected versions include all iterations of WPGraphQL Smart Cache prior to version 2.3.2."
}