CVE-2026-119701 WPGraphQL before 2.24.1 Email Flooding via Aliased sendPasswordResetEmail Mutations

WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to flood password reset emails by aliasing the sendPasswordResetEmail mutation. Attackers can send one HTTP request with many aliases, bypassing batchlimit, to exhaust mail provider quota...

CVE-2026-119701 WPGraphQL before 2.24.1 Email Flooding via Aliased sendPasswordResetEmail Mutations

WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to flood password reset emails by aliasing the sendPasswordResetEmail mutation. Attackers can send one HTTP request with many aliases, bypassing batchlimit, to exhaust mail provider quota...

CVE-2026-119701

The WPGraphQL plugin (versions prior to 2.24.1 ) is vulnerable to an email flooding attack due to a missing rate limiting flaw. Unauthenticated attackers can exploit the sendPasswordResetEmail mutation by using multiple aliases within a single HTTP request. This technique bypasses the batch_limit...