CVE-2026-110023

Name of the Vulnerable Software and Affected Versions WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps versions prior to 5.5.89

Description An issue exists that allows unauthenticated attackers to extract all rows and columns from the database table associated with any anonymously published app. This includes sensitive data such as WordPress user password hashes, email addresses, and password-reset keys from the wp users table. The flaw is triggered via the rel tab parameter. Exploitation is possible if an administrator has published at least one app with its REST API authorization configured as 'anonymous', which is the default setting for publicly embedded apps.

Recommendations Update to a version newer than 5.5.88. Avoid setting REST API authorization to 'anonymous' for published apps to minimize the risk of data exposure.