Threats tagged 'ghsa-f8vm-v352-pm3p'

WPGraphQL versions prior to 2.24.1 have a vulnerability due to missing rate limiting on the sendPasswordResetEmail mutation. This allows unauthenticated attackers to send numerous password reset emails by aliasing the mutation in a single HTTP request, bypassing batch limits. The attack can exhaust the mail provider quota and repeatedly rotate reset keys, effectively blocking legitimate users from recovering their passwords.