Vulnerabilities / WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps / WPSEC-2026-1966
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps <= 5.5.89 - Unauthenticated Missing Authorization to App Export and Copy
Medium 4.8
CWE-862Fixed in 5.5.90
- ID
- WPSEC-2026-1966
- Plugin
- WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps (wp-data-access)
- Affected
- all versions before 5.5.90
- Remediation
- Update to 5.5.90 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-29
- Attack surface
- WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps on WPSec AttackSurface
- Fix released
- Published
Description
The WP Data Access plugin for WordPress is vulnerable to unauthorized access via the app/export and app/copy REST endpoints in all versions up to, and including, 5.5.89. This is due to the endpoints checking only whether the user may run the app, not whether the user is an administrator. This makes it possible for unauthenticated attackers, when the app is set to anonymous access (or authenticated users granted access to the app), to export the full app definition, including container SQL, table settings and authorized user lists, and to create copies of the app.
References
- https://wpsec.com/vuln/WPSEC-2026-1966/
- https://plugins.svn.wordpress.org/wp-data-access/tags/5.5.90/
- https://wordpress.org/plugins/wp-data-access/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS