CVE-2026-118267

Name of the Vulnerable Software and Affected Versions WP Data Access versions prior to 5.5.89

Description Incorrect authorization allows for privilege escalation. The plugin fails to enforce row-filter (defaultWhere) or per-column allow-list (isSelected) restrictions on write endpoints, unlike the read endpoints. This allows authenticated users with Subscriber-level access or higher, or unauthenticated users if the rest api.authorization is set to 'anonymous', to write to arbitrary rows and columns. An attacker can overwrite the user pass field of the WordPress administrator account in the wp users table to achieve full site takeover. This occurs when an administrator publishes a Data App that enables write transactions (update, delete, or insert). The affected endpoints are 'wpda/app/update', 'wpda/app/delete', and 'wpda/app/insert', which pass the key and val parameters directly to the $wpdadb->update, $wpdadb->delete, and $wpdadb->insert functions.

Recommendations Update WP Data Access to a version newer than 5.5.89. As a temporary mitigation, restrict or disable write transactions (update, delete, or insert) in published Data Apps for Subscriber-level or anonymous users.