6.5
Medium
CVE-2026-92099 The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authorisation or validate a caller-supplied…
Description
The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authorisation or validate a caller-supplied query identifier before storing a persisted query from a request, allowing unauthenticated users to publish arbitrary query documents and claim query aliases before a site's own frontend registers them.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| WPGraphQL Smart Cache 2.3 | earliest → < 2.3.2 | 2.3.2 |