PatchSiren

PatchSiren cyber security CVE debrief

CVE-2021-47959 Wpgraphql CVE debrief

CVE-2021-47959 is a high-severity denial-of-service issue in WPGraphQL 1.3.5. According to the supplied record, an unauthenticated attacker can send batched GraphQL queries with duplicated fields to exhaust server resources, leading to out-of-memory conditions and MySQL connection errors. The supplied CVE record was published on 2026-05-15 and modified on 2026-05-18.

Vendor
Wpgraphql
Product
Unknown
CVSS
HIGH 8.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-15
Original CVE updated
2026-05-18
Advisory published
2026-05-15
Advisory updated
2026-05-18

Who should care

WordPress administrators, site operators, and security teams running WPGraphQL—especially on internet-facing WordPress deployments that expose the GraphQL endpoint—should treat this as a service-availability risk.

Technical summary

The source corpus describes an unauthenticated application-layer denial of service against the WPGraphQL plugin. The issue is triggered by POST requests to the GraphQL endpoint containing batched queries with duplicated fields, which can amplify server work and consume memory and database connections until the application becomes unavailable. The provided metadata cites CWE-770 (Allocation of Resources Without Limits or Throttling).

Defensive priority

High. This is an unauthenticated remote denial-of-service condition affecting availability, with the potential to take down the WordPress application or create database instability.

Recommended defensive actions

  • Determine whether WPGraphQL is installed and whether version 1.3.5 is in use.
  • Review the vendor advisory and project guidance for any patched release or mitigation steps.
  • Restrict exposure of the GraphQL endpoint where possible, especially for unauthenticated traffic.
  • Apply rate limiting and request size/complexity controls at the application, reverse proxy, or WAF layer.
  • Monitor web server, PHP, and database logs for repeated GraphQL POST requests and resource-exhaustion errors.
  • Add operational safeguards such as memory and connection monitoring so service degradation is detected quickly.
  • If the plugin is not required, consider disabling or removing it until a remediated version or mitigation is confirmed.

Evidence notes

The summary is based only on the supplied CVE description and NVD source metadata. The record references an Exploit-DB disclosure, a VulnCheck advisory, and the WPGraphQL project site. NVD lists the record with vulnStatus set to Deferred. No exploit details or reproduction steps are included here.

Sources and references

Verified primary and authoritative sources

  • CVE-2021-47959 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2021-47959

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2021-47959 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2021-47959

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.