{"id":"CVE-2026-92099","published":"2026-09-19T07:16:33.583","lastModified":"2026-09-21T13:34:57.127","description":"The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authorisation or validate a caller-supplied query identifier before storing a persisted query from a request, allowing unauthenticated users to publish arbitrary query documents and claim query aliases before a site's own frontend registers them.","cvssScore":6.5,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","cwes":["CWE-284"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/3563529f-5050-4f92-9a3c-44ee850254bd/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}