CVE-2026-3235

Name of the Vulnerable Software and Affected Versions WP Data Access versions prior to 5.5.69

Description The plugin contains an Insecure Direct Object Reference (IDOR) flaw, which occurs when an application provides direct access to objects based on user-supplied input. The issue exists in the check app access() function due to missing validation on a user-controlled key. Unauthenticated attackers can access data from protected app containers by exploiting a mismatch where the authorization check is performed against the app id variable, but data retrieval is performed using the cnt id variable without verifying container ownership.

Recommendations Update the plugin to a version newer than 5.5.68. As a temporary mitigation, restrict access to the check app access() function.