WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps <= 5.5.89 - Unauthenticated Missing Authorization to Out-of-Scope Row and Column Modification via App Insert, Update and Delete Endpoints
- ID
- WPSEC-2026-1964
- Plugin
- WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps (wp-data-access)
- Affected
- all versions before 5.5.90
- Remediation
- Update to 5.5.90 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
- Weakness
- CWE-863
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-29
- Attack surface
- WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps on WPSec AttackSurface
- Fix released
- Published
Description
The WP Data Access plugin for WordPress is vulnerable to unauthorized data modification via the app/insert, app/update and app/delete REST endpoints in all versions up to, and including, 5.5.89. The handlers did not apply the container's default WHERE row filter, and they did not limit written columns to the columns defined in the app form. This makes it possible for unauthenticated attackers, when an app with data modification enabled is set to anonymous access (or authenticated users granted access to such an app), to write any column of the underlying table and to update or delete rows outside the subset of data the app is configured to expose.
References
- https://wpsec.com/vuln/WPSEC-2026-1964/
- https://plugins.svn.wordpress.org/wp-data-access/tags/5.5.90/
- https://wordpress.org/plugins/wp-data-access/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS