WP Data Access CVE-2026-106099

Exploitation requires that the target site actively uses the WP Data Access plugin (before 5.5.84) to publish a database table on a publicly accessible page - the export action and its gating token only appear where such a table is displayed. No authentication, user interaction, or special privileges are required against those pages, and the attacker simply reuses the token the plugin itself prints publicly. The practical limiting factor is deployment-specific: impact is bounded to data in tables the site chooses to display, so sites that do not publicly display WP Data Access tables, or whose displayed tables contain no sensitive hidden columns/rows, face little to no real exposure. Only Low confidentiality impact results - no data modification or denial of service.

This is a genuine but moderate-severity information-disclosure flaw. The provided CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3 Medium) is internally consistent with the description: exploitation is network-based, low-complexity, and requires no authentication because the gating token is printed by the plugin itself into the public page displaying the table. Confidentiality impact is correctly scoped as Low (C:L) since only data from tables the site already chooses to display publicly is exposed - albeit including columns/rows hidden from the rendered view - with no integrity or availability impact. Signals mostly agree on 'real but not urgent': publicly available exploit code exists (reported by WPScan), which raises practical exploitability, yet EPSS is low at 0.18% (7th percentile) and the vulnerability is NOT in CISA KEV. SSVC reinforces this nuance - Exploitation: none (no observed in-the-wild activity), Automatable: yes (unauthenticated, scriptable harvesting across many sites), Technical Impact: partial. The combination of low EPSS, no KEV listing, but POC + automatable suggests opportunistic/automated data scraping is plausible even though mass exploitation has not been confirmed. Verdict: prioritize patching for sites that use WP Data Access to publish tables containing any sensitive hidden columns, but this is not a drop-everything critical issue.

A site uses WP Data Access to display a filtered/limited table to visitors, trusting that hidden columns and rows are not exposed. An unauthenticated attacker views the public page, reads the export token the plugin embeds in the page HTML, and then invokes the plugin's export action with that token to download the complete underlying table - including columns and rows withheld from the visible display. Public exploit code is available (WPScan), making this trivially repeatable and scriptable across affected sites.