WPGraphQL Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in the WordPress plugin WPGraphQL, version 1.3.5. This vulnerability allows unauthenticated attackers to exhaust server resources by sending batched GraphQL queries that include duplicated fields. The exploitation of this vulnerability can lead to out-of-memory conditions on the server and MySQL connection errors.

Impact

Exploitation of this vulnerability causes severe resource exhaustion on the server, leading to out-of-memory conditions and MySQL connection errors.

Reproduction

The vulnerability can be reproduced by sending POST requests to the WordPress GraphQL endpoint with amplified field duplication payloads. This can be done using a Python script that batches queries with duplicated fields, effectively overwhelming the server's resources.