{"schemaVersion":3,"id":"CVE-2021-31157","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"The WPGraphQL plugin for WordPress is vulnerable to Denial of Service via field duplication in versions up to, and including, 1.3.5. This makes it possible for unauthenticated attackers to rapidly duplicate fields and queries resulting in OOM and MySQL connection errors.","dates":{"published":"2021-04-27T00:00:00.000Z","modified":"2024-01-22T19:56:02.000Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":5.3,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"wordfence","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"wordfence","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-400","name":"Uncontrolled Resource Consumption","description":"The product does not properly control the allocation and maintenance of a limited resource.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/400.html"}],"affected":[{"vendor":"wordpress","product":"wp-graphql","name":"WPGraphQL","label":"wp-graphql","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 1.3.5 (fixed in 1.3.6)","noFixRecorded":false,"fixedIn":"1.3.6"}],"versionsText":"≤ 1.3.5 (fixed in 1.3.6)","eol":null,"hubHref":null}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/dd22276b-41d4-4795-a79e-d770d0cf4b76","label":"www.wordfence.com/threat-intel/vulnerabilities/id/dd22276b-41d4-4795-a79e-d770d0cf4b76","hostname":"www.wordfence.com","tags":["Vendor Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2021-04-27T00:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-01-22T19:56:02.000Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":21,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T09:30:00.354Z","stale":false,"partial":false}}