CVE-2026-42665

The WP Data Access plugin versions 5.5.84 and earlier contain an unauthenticated SQL Injection vulnerability. A remote attacker can exploit this to execute unauthorized queries against the database.

Unauthenticated Broken Access Control in WP Data Access <= 5.5.80 versions.

SQL injection vulnerability in WP Data Access allows blind SQL injection. Affects versions up to 5.5.82.

An unauthenticated SQL Injection vulnerability was detected in WP Data Access versions up to 5.5.81. This vulnerability may allow an attacker to manipulate database queries.

The WP Data Access plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 5.5.88 via the 'rel_tab' parameter. An unauthenticated attacker can extract all rows and columns of the database table backing any anonymously published app, including user password hashes, email addresses, and password-reset keys. This requires an administrator to have published at least one app with REST API authorization set to 'anonymous'.

Author-level Cross Site Scripting (XSS) vulnerability in WP Data Access plugin versions up to and including 5.5.79.

Cross Site Scripting (XSS) vulnerability in WP Data Access plugin up to version 5.5.79, allowing an unauthenticated attacker to inject malicious scripts into pages.