{
 "id": "WPSEC-2026-2607",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2607/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2607/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2607/index.md",
 "title": "WP Data Access <= 5.5.90 - Cross-Site Request Forgery via Data Designer",
 "description": "The WP Data Access plugin for WordPress is vulnerable to Cross-Site Request Forgery via the Data Designer in all versions up to, and including, 5.5.90, due to missing or incorrect nonce validation. The nonce was checked only at the end of the Data Designer form constructor, after the repository insert, update, reconcile and reverse-engineering actions and the create table, alter table, create index, drop table and drop index actions had already run. The check was also skipped whenever a table name was supplied. This makes it possible for unauthenticated attackers to change the table design repository and to create, alter or drop non-core database tables and indexes through a forged request, granted they can trick a site administrator into performing an action such as clicking a link.",
 "plugin": {
  "slug": "wp-data-access",
  "name": "WP Data Access",
  "full_name": "WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps",
  "wordpress_org": "https://wordpress.org/plugins/wp-data-access/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-data-access/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-data-access"
 },
 "type": "CSRF",
 "cwe": [
  "CWE-352"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.1,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.5.91",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.5.91"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.5.91",
 "remediation": "Update to 5.5.91 or later.",
 "fix_released": "2026-11-04T18:02:46+00:00",
 "published": "2026-11-05T18:43:11+00:00",
 "updated": "2026-11-05T09:51:12.073701+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2607/",
  "https://plugins.svn.wordpress.org/wp-data-access/tags/5.5.91/",
  "https://wordpress.org/plugins/wp-data-access/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-data-access",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-05"
 }
}