EUVD-2026-54895
GHSA-chrp-6wq4-c4qg
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable unauthenticated AJAX endpoint, no complexity beyond locating a public form; high confidentiality impact from hash exposure; no integrity or availability impact.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
5DescriptionCVE.org
The WP Data Access WordPress plugin before 5.5.79 does not validate the column names it accepts on one of its unauthenticated AJAX actions, and the nonce guarding that action does not cover them, allowing unauthenticated attackers to read arbitrary columns of the database table the affected front-end form is bound to, including user password hashes where that table is the users table.
AnalysisAI
Unauthenticated column enumeration in the WP Data Access WordPress plugin (all versions before 5.5.79) allows remote attackers to read arbitrary database column values from any table bound to a public front-end form, with the most critical exposure occurring when that table is the WordPress users table - enabling retrieval of all stored password hashes. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms zero-barrier network exploitation with no authentication required. No public exploit has been identified at time of analysis, and the EPSS score of 0.14% (4th percentile) indicates negligible observed exploitation activity, though the attack surface is straightforward once a vulnerable form is located.
Technical ContextAI
WP Data Access is a WordPress plugin that allows administrators to bind WordPress database tables to configurable front-end data grids and AJAX-driven forms. The root cause is an unauthenticated AJAX action handler that accepts attacker-supplied column names as request parameters without validating them against a permitted allowlist. WordPress nonces serve as CSRF tokens to protect these actions, but in this case the nonce validation does not cover the column name parameter - meaning column names bypass the only access-control gate on the endpoint. An attacker can therefore inject arbitrary column names into a legitimate AJAX request and retrieve their values from whatever database table the form is configured to query. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) is the applicable root cause class: the application returns data that should be restricted because it does not enforce column-level access control before including query results in the response. The affected version range, per EUVD-2026-54895, is WP Data Access 0 through 5.5.78.
RemediationAI
The primary fix is to update WP Data Access to version 5.5.79 or later, which introduces server-side validation of column names against a permitted list. Administrators should apply this update immediately via the WordPress admin dashboard or via WP-CLI. The vendor patch is confirmed available per the advisory at https://wpscan.com/vulnerability/1b6c5935-c8e0-4b9b-9ba6-0f16a0e2cdae/. If immediate patching is not possible, the most effective compensating control is to deactivate or remove all public-facing front-end forms created with WP Data Access until the update can be applied - this eliminates the exposed AJAX endpoint entirely. Alternatively, a web application firewall rule blocking POST requests to wp-admin/admin-ajax.php that include unexpected column name parameters may reduce exposure, but this is fragile and highly configuration-dependent. Network-level blocking is not practical as the AJAX endpoint must remain accessible to legitimate users. There are no known side effects to upgrading to 5.5.79 reported at time of analysis.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today