CVE-2026-92099: CWE-284 Improper Access Control in WPGraphQL Smart Cache
The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authorisation or validate a caller-supplied query identifier before storing a persisted query from a request, allowing unauthenticated users to publish arbitrary query documents and claim query aliases before a site's own frontend registers them.
AI Analysis
Technical Summary
The WPGraphQL Smart Cache WordPress plugin prior to version 2.3.2 does not enforce authorization or validate caller-supplied query identifiers when storing persisted queries. As a result, unauthenticated users can submit and register arbitrary queries, potentially interfering with the site's intended query handling by preempting legitimate query aliases.
Potential Impact
Unauthenticated attackers can publish arbitrary persisted queries and claim query aliases, which may disrupt normal query operations or lead to unauthorized query execution. The exact impact depends on how the persisted queries are used by the site, but the vulnerability allows unauthorized control over query registration.
Mitigation Recommendations
Upgrade WPGraphQL Smart Cache to version 2.3.2 or later where this issue is fixed. Since the vulnerability is addressed in this version, applying the official update is the recommended remediation.
CVE-2026-92099: CWE-284 Improper Access Control in WPGraphQL Smart Cache
Description
The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authorisation or validate a caller-supplied query identifier before storing a persisted query from a request, allowing unauthenticated users to publish arbitrary query documents and claim query aliases before a site's own frontend registers them.
CVSS v3.1
Score 6.5medium
Affected software
WPGraphQL Smart Cache
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The WPGraphQL Smart Cache WordPress plugin prior to version 2.3.2 does not enforce authorization or validate caller-supplied query identifiers when storing persisted queries. As a result, unauthenticated users can submit and register arbitrary queries, potentially interfering with the site's intended query handling by preempting legitimate query aliases.
Potential Impact
Unauthenticated attackers can publish arbitrary persisted queries and claim query aliases, which may disrupt normal query operations or lead to unauthorized query execution. The exact impact depends on how the persisted queries are used by the site, but the vulnerability allows unauthorized control over query registration.
Mitigation Recommendations
Upgrade WPGraphQL Smart Cache to version 2.3.2 or later where this issue is fixed. Since the vulnerability is addressed in this version, applying the official update is the recommended remediation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-09-15T15:23:48.221Z
- State
- PUBLISHED
Threat ID: 6aae2c6955bf5e2cf5363add
Added to database: 09/19/2026, 06:32:09 UTC
Last enriched: 09/19/2026, 06:46:51 UTC
Last updated: 09/19/2026, 22:12:52 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.