CVE-2026-18032

Name of the Vulnerable Software and Affected Versions WP Data Access versions prior to 5.5.79

Description An issue exists where the plugin fails to validate column names accepted during an unauthenticated AJAX action. Because the nonce guarding this action does not cover the column names, unauthenticated attackers can read arbitrary columns from the database table linked to the affected front-end form. This could lead to the disclosure of sensitive information, such as user password hashes, if the table is the users table.

Recommendations Update WP Data Access to version 5.5.79 or later.