WordPress Plugin WPGraphQL 1.3.5 contains a resource‑exhaustion flaw that can be triggered by unauthenticated attackers. By sending POST requests to the GraphQL endpoint with payloads that repeat the same field many times, the server is forced to allocate excessive memory and can trigger out‑of‑memory conditions and MySQL connection errors. The result is a denial of service that renders the affected WordPress site unavailable to legitimate users.

The vulnerability exists in the WPGraphQL plugin for WordPress. Versions existing at purchase of 1.3.5 or earlier are impacted. The plugin exposes a /graphql endpoint on a standard WordPress installation, which can be accessed by anyone with network access to the site.

The CVSS score of 8.7 points to high severity. The EPSS score is currently not available, so the precise likelihood of widespread exploitation is unknown, but the vulnerability is not listed in the CISA KEV catalog and no public exploits have been reported. The attack vector is indirect: an unauthenticated attacker only needs to reach the open GraphQL endpoint, which is typically publicly exposed on a WordPress website. Successful exploitation would allow the attacker to exhaust server resources and disrupt site availability.