CVE-2026-110023
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
The WP Data Access plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 5.5.88 via the 'rel_tab' parameter. An unauthenticated attacker can extract all rows and columns of the database table backing any anonymously published app, including user password hashes, email addresses, and password-reset keys. This requires an administrator to have published at least one app with REST API authorization set to 'anonymous'.
Risk Assessment
This can lead to mass leakage of credentials and personal information, enabling account takeover and further attacks. It represents a serious breach of data confidentiality.
Recommendation
Update the WP Data Access plugin to a version later than 5.5.88. Immediately review app configurations and change REST API authorization settings from 'anonymous' to require authentication.
Other vulnerabilities in WP Data Access
See all- CVE-2026-93621High
The WP Data Access plugin versions 5.5.84 and earlier contain an unauthenticated SQL Injection vulnerability. A remote attacker can exploit this to execute unauthorized queries against the database.
- CVE-2026-66595Medium
Unauthenticated Broken Access Control in WP Data Access <= 5.5.80 versions.
- CVE-2026-95605Critical
SQL injection vulnerability in WP Data Access allows blind SQL injection. Affects versions up to 5.5.82.
- CVE-2026-81293Critical
An unauthenticated SQL Injection vulnerability was detected in WP Data Access versions up to 5.5.81. This vulnerability may allow an attacker to manipulate database queries.
- CVE-2026-42665Critical
There is an unauthenticated SQL Injection vulnerability in WP Data Access versions <= 5.5.70.
- CVE-2026-73344Medium
Author-level Cross Site Scripting (XSS) vulnerability in WP Data Access plugin versions up to and including 5.5.79.
- CVE-2026-66663High
Cross Site Scripting (XSS) vulnerability in WP Data Access plugin up to version 5.5.79, allowing an unauthenticated attacker to inject malicious scripts into pages.
Original NVD description (English source)
The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.5.88 via the 'rel_tab' parameter. This makes it possible for unauthenticated attackers to extract every row and column of the underlying database table backing any anonymously published app, including WordPress user password hashes, email addresses, and password-reset keys from wp_users. Exploitation requires that an administrator has published at least one app with its REST API authorization set to 'anonymous', which is the standard configuration for publicly embedded apps.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS