WP Data Access <= 5.5.90 - Cross-Site Request Forgery via Data Designer
- ID
- WPSEC-2026-2607
- Plugin
- WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps (wp-data-access)
- Affected
- all versions before 5.5.91
- Remediation
- Update to 5.5.91 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
- Weakness
- CWE-352
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-05
- Attack surface
- WP Data Access on WPSec AttackSurface
- Fix released
- Published
Description
The WP Data Access plugin for WordPress is vulnerable to Cross-Site Request Forgery via the Data Designer in all versions up to, and including, 5.5.90, due to missing or incorrect nonce validation. The nonce was checked only at the end of the Data Designer form constructor, after the repository insert, update, reconcile and reverse-engineering actions and the create table, alter table, create index, drop table and drop index actions had already run. The check was also skipped whenever a table name was supplied. This makes it possible for unauthenticated attackers to change the table design repository and to create, alter or drop non-core database tables and indexes through a forged request, granted they can trick a site administrator into performing an action such as clicking a link.
References
- https://wpsec.com/vuln/WPSEC-2026-2607/
- https://plugins.svn.wordpress.org/wp-data-access/tags/5.5.91/
- https://wordpress.org/plugins/wp-data-access/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS