Description
WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to flood password reset emails by aliasing the sendPasswordResetEmail mutation. Attackers can send one HTTP request with many aliases, bypassing batch_limit, to exhaust mail provider quota and repeatedly rotate reset keys, blocking legitimate password recovery.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
WPGraphQL WPGraphQL
Default version status: unaffected
0 to < 2.24.1affected
References
- https://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-f5f8-v768-93c8 ↗
- https://github.com/wp-graphql/wp-graphql/commit/760db555e3e60fbd86c1d96f1689bacfc9265592 ↗
- https://github.com/wp-graphql/wp-graphql/blob/wp-graphql/v2.24.0/plugins/wp-graphql/src/Mutation/SendPasswordResetEmail.php ↗
- https://github.com/wp-graphql/wp-graphql/releases/tag/wp-graphql%2Fv2.24.1 ↗
- https://github.com/wp-graphql/wp-graphql ↗
- https://www.vulncheck.com/advisories/wpgraphql-before-2.24.1-email-flooding-via-aliased-sendpasswordresetemail-mutations ↗