{
 "id": "WPSEC-2026-1964",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1964/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1964/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1964/index.md",
 "title": "WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps <= 5.5.89 - Unauthenticated Missing Authorization to Out-of-Scope Row and Column Modification via App Insert, Update and Delete Endpoints",
 "description": "The WP Data Access plugin for WordPress is vulnerable to unauthorized data modification via the app/insert, app/update and app/delete REST endpoints in all versions up to, and including, 5.5.89. The handlers did not apply the container's default WHERE row filter, and they did not limit written columns to the columns defined in the app form. This makes it possible for unauthenticated attackers, when an app with data modification enabled is set to anonymous access (or authenticated users granted access to such an app), to write any column of the underlying table and to update or delete rows outside the subset of data the app is configured to expose.",
 "plugin": {
  "slug": "wp-data-access",
  "name": "WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps",
  "full_name": "WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps",
  "wordpress_org": "https://wordpress.org/plugins/wp-data-access/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-data-access/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-data-access"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-863"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.8,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.5.90",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.5.90"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.5.90",
 "remediation": "Update to 5.5.90 or later.",
 "fix_released": "2026-10-28T18:01:26+00:00",
 "published": "2026-10-29T18:50:39+00:00",
 "updated": "2026-10-29T17:42:20.508749+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1964/",
  "https://plugins.svn.wordpress.org/wp-data-access/tags/5.5.90/",
  "https://wordpress.org/plugins/wp-data-access/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-data-access",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-29"
 }
}