CVE-2026-92099 - WPGraphQL Smart Cache < 2.3.2 - Unauthenticated Persisted Query Registration and Alias Squatting

Back Back to CVE browser

MEDIUM

WPGraphQL Smart Cache < 2.3.2 - Unauthenticated Persisted Query Registration and Alias Squatting

Published Sep 19, 2026

6.5

MEDIUM

CVSS 3.1

EPSS 0.34%

Description

The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authorisation or validate a caller-supplied query identifier before storing a persisted query from a request, allowing unauthenticated users to publish arbitrary query documents and claim query aliases before a site's own frontend registers them.

Affected products

Vendor n/a Product WPGraphQL Smart Cache Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <2.3.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

WPGraphQL Smart Cache

unaffected

Version	Status	Constraints
0	affected	<2.3.2

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-284

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-83510
Advisory
https://wpscan.com/vulnerability/3563529f-5050-4f92-9a3c-44ee850254bd/
exploitvdb-entrytechnical-description

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-83510		Advisory
https://wpscan.com/vulnerability/3563529f-5050-4f92-9a3c-44ee850254bd/		exploitvdb-entrytechnical-description