WP Data Access CVE-2026-106098

Exploitation requires that an administrator has configured a WP Data Access 'application' to be exposed for anonymous (public) read access; the flaw lets unauthenticated requests reach a REST endpoint that validates only read permission before performing a write. The key limiting factor is this configuration precondition - sites with no anonymously-readable application are not exploitable - and the impact is bounded to modifying data within that exposed application (no confidentiality or availability impact). Notably, the administrator's explicit disabling of update actions does NOT limit exploitation, because the broken authorization check bypasses that control. No user interaction or authentication is required against the vulnerable endpoint (PR:N/UI:N confirmed by CVSS).

This is a moderate, not top-priority, issue whose signals are internally consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3) describes a network-reachable, low-complexity, unauthenticated flaw with only low integrity impact and no confidentiality or availability impact - matching the description of a broken authorization check (CWE-863) that permits writes through a read-only REST endpoint. SSVC agrees: Exploitation=none (no observed in-the-wild activity), Automatable=yes (reachable and scriptable at scale), Technical Impact=partial. EPSS is low at 0.17% (5th percentile), and the CVE is NOT in CISA KEV, so there is no evidence of active exploitation despite publicly available exploit code from WPScan. The dominant signals - publicly available PoC plus Automatable=yes - mean mass opportunistic scanning is plausible, but the real-world impact ceiling is capped at data modification of an already anonymously-readable application, which limits the severity. Net: a genuine but medium-grade data-integrity issue worth patching promptly on affected sites, not an emergency. Note one nuance requiring judgment: the PR:N rating is valid for the vulnerable endpoint itself, but practical impact depends on the administrator having configured an application for anonymous read access - a precondition not captured in the CVSS vector.

An attacker identifies a WordPress site running WP Data Access below 5.5.77 that exposes a data application for anonymous read access. Because the vulnerable REST endpoint only checks read permission before executing a write, the unauthenticated attacker sends a crafted request to that endpoint and modifies records even though the administrator disabled update actions. Publicly available exploit code from WPScan lowers the skill barrier, and the low complexity makes this scriptable across many targets.