Read the docs
TI-2026-83510 Aliases CVE-2026-110023GHSA-xvpx-j2j6-gqv3

Missing authorization in WP Data Access exposes database rows

Priority LOW 26CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

The WP Data Access plugin for WordPress, in all versions up to and including 5.5.88, lacks an authorization check on the rel_tab parameter (CWE-862). An unauthenticated remote attacker can extract every row and column of the database table behind an app published with anonymous REST API access, including user password hashes, email addresses and password-reset keys from wp_users. Exploitation requires an app published with anonymous REST API authorization.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.5.88 via the 'rel_tab' parameter. This makes it possible for unauthenticated attackers to extract every row and column of the underlying database table backing any anonymously published app, including WordPress user password hashes, email addresses, and password-reset keys from wp_users. Exploitation requires that an administrator has published at least one app with its REST API authorization set to 'anonymous', which is the standard configuration for publicly embedded apps.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0029 21st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
peterschulznlWP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Mapsup to 5.5.88—No fix listedCNA
  • WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps Vendorpeterschulznl Affected up to 5.5.88 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for WP Data Access.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Timeline

  1. 2026-10-31 Threatist record created from CVE-2026-110023
  2. 2026-10-31 Alias added: GHSA-xvpx-j2j6-gqv3
  3. 2026-11-01 Priority changed: MEDIUM → LOW
  4. 2026-11-03 CISA SSVC decision points changed

References

Other 7

  • TI-2026-86553 Incorrect authorization in WP Data Access allows privilege escalation CVSS 3.1HIGH 8.1
  • TI-2024-11530 WP Data Access – App, Table, Form and Chart Builder plugin <= 5.5.22 - Unauthenticated SQL Injection CVSS 3.1HIGH 7.5
  • TI-2026-02796 Authorization bypass in peterschulznl WP Data Access – App Builder for Tables, Forms… CVSS 3.1MEDIUM 5.3
  • TI-2026-86444 Stored cross-site scripting in WP Data Access WordPress plugin CVSS 3.1MEDIUM 6.4
  • TI-2026-86441 Stored cross-site scripting in WP Data Access WordPress plugin CVSS 3.1MEDIUM 6.4
  • TI-2026-86440 Stored cross-site scripting in WP Data Access WordPress plugin CVSS 3.1MEDIUM 6.4
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences