# WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps <= 5.5.89 - Unauthenticated Missing Authorization to Out-of-Scope Row and Column Modification via App Insert, Update and Delete Endpoints

- **ID:** WPSEC-2026-1964
- **Plugin:** WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps (`wp-data-access`), https://wordpress.org/plugins/wp-data-access/
- **Affected versions:** all versions before 5.5.90
- **Fixed in:** 5.5.90 (Update to 5.5.90 or later.)
- **Severity:** Medium 4.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L)
- **Weakness:** CWE-863
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-29)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-data-access
- **Fix released:** 2026-10-28
- **Published:** 2026-10-29
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1964/

## Description

The WP Data Access plugin for WordPress is vulnerable to unauthorized data modification via the app/insert, app/update and app/delete REST endpoints in all versions up to, and including, 5.5.89. The handlers did not apply the container's default WHERE row filter, and they did not limit written columns to the columns defined in the app form. This makes it possible for unauthenticated attackers, when an app with data modification enabled is set to anonymous access (or authenticated users granted access to such an app), to write any column of the underlying table and to update or delete rows outside the subset of data the app is configured to expose.

## References

- https://wpsec.com/vuln/WPSEC-2026-1964/
- https://plugins.svn.wordpress.org/wp-data-access/tags/5.5.90/
- https://wordpress.org/plugins/wp-data-access/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1964/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.