6.5
Moyenne
CVE-2026-92099 The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authorisation or validate a caller-supplied…
Description
The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authorisation or validate a caller-supplied query identifier before storing a persisted query from a request, allowing unauthenticated users to publish arbitrary query documents and claim query aliases before a site's own frontend registers them.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| WPGraphQL Smart Cache 2.3 | premières → < 2.3.2 | 2.3.2 |