An unauthenticated resource exhaustion vulnerability in WordPress plugin WPGraphQL 1.3.5 allows remote attackers to cause a denial-of-service condition.

This vulnerability (CWE-770) occurs because the plugin fails to properly limit or throttle resource allocation. The CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms that the attack is fully automatable and requires no authentication or user interaction to execute.

By overwhelming the system with resource-intensive requests, an attacker can crash the plugin or the underlying WordPress site, leading to significant downtime. Given the 7.5 CVSS score, this represents a critical risk to business availability, particularly for high-traffic websites that rely on WPGraphQL for data integration.

Immediate Action: Disable the WPGraphQL plugin if it is not strictly required for site functionality until an official patch is released.

Proactive Monitoring: Monitor server resource utilization (CPU/Memory) for sudden spikes and review access logs for high-frequency GraphQL queries from single source IPs.

Compensating Controls: Configure a WAF or API gateway to rate-limit GraphQL queries and block requests that exhibit patterns characteristic of resource exhaustion attempts.

Public Exploit Available: Yes — an entry exists on ExploitDB.

Organizations utilizing WPGraphQL 1.3.5 should exercise extreme caution. Given the availability of a public proof-of-concept and the potential for easy remote exploitation, we strongly recommend disabling the plugin or implementing robust rate-limiting controls to prevent service disruption until a patched version is deployed.