{
 "id": "WPSEC-2026-1966",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1966/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1966/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1966/index.md",
 "title": "WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps <= 5.5.89 - Unauthenticated Missing Authorization to App Export and Copy",
 "description": "The WP Data Access plugin for WordPress is vulnerable to unauthorized access via the app/export and app/copy REST endpoints in all versions up to, and including, 5.5.89. This is due to the endpoints checking only whether the user may run the app, not whether the user is an administrator. This makes it possible for unauthenticated attackers, when the app is set to anonymous access (or authenticated users granted access to the app), to export the full app definition, including container SQL, table settings and authorized user lists, and to create copies of the app.",
 "plugin": {
  "slug": "wp-data-access",
  "name": "WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps",
  "full_name": "WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps",
  "wordpress_org": "https://wordpress.org/plugins/wp-data-access/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-data-access/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-data-access"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.8,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.5.90",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.5.90"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.5.90",
 "remediation": "Update to 5.5.90 or later.",
 "fix_released": "2026-10-28T18:01:26+00:00",
 "published": "2026-10-29T18:50:39+00:00",
 "updated": "2026-10-29T17:42:20.508749+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1966/",
  "https://plugins.svn.wordpress.org/wp-data-access/tags/5.5.90/",
  "https://wordpress.org/plugins/wp-data-access/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-data-access",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-29"
 }
}