Vulnerabilities

TI-2024-28947 CVE-2024-43295 · GHSA-5fhp-588g-xh47

WordPress WP Data Access plugin <= 5.5.7 - Cross Site Request Forgery (CSRF) vulnerability

LOW 19

Cross-Site Request Forgery (CSRF) vulnerability in Passionate Programmers B.V.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00183 Published 2024-08-26 No fix listed CWE-352

TI-2023-01761 CVE-2023-1874 · GHSA-6f4x-x656-q884

WP Data Access <= 5.3.7 - Authenticated (Subscriber+) Privilege Escalation

MEDIUM 45

The WP Data Access plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.3.7.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02726 Published 2023-04-12 No fix listed CWE-266

TI-2021-07148 CVE-2021-24866 · GHSA-6857-r4gq-xgmw

WP Data Access < 5.0.0 - Admin+ SQL Injection

MEDIUM 45

The WP Data Access WordPress plugin before 5.0.0 does not properly sanitise and escape the backup_date parameter before using it a SQL statement, leading to a SQL injection issue and could allow arbitrary table deletion

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01627 Published 2021-12-06 Fixed in 5.0.0 CWE-89

Vulnerabilities

Filters

WordPress WP Data Access plugin <= 5.5.7 - Cross Site Request Forgery (CSRF) vulnerability

WP Data Access <= 5.3.7 - Authenticated (Subscriber+) Privilege Escalation

WP Data Access < 5.0.0 - Admin+ SQL Injection