WP Data Access CVE-2026-66595

The WP Data Access plugin must be installed and active on the target WordPress site in version 5.5.80 or earlier. Exploitation requires no WordPress authentication (PR:N confirmed by CVSS vector), meaning no valid site account is needed. However, the high attack complexity (AC:H) means exploitation is not reliably repeatable against arbitrary sites and requires specific conditions to align - the precise feature, endpoint, or configuration setting that triggers the missing authorization check is not identified in the available data and must be derived from the full Patchstack advisory. Exploitation is bounded to confidentiality impact only (C:H, I:N, A:N): attackers can read protected data but cannot write, modify, or destroy data via this flaw alone. Defenders should note that the AC:H constraint significantly limits the risk from automated mass scanning compared to a low-complexity unauthenticated bypass.

The CVSS 3.1 score of 5.9 reflects a meaningful tension: C:H (High Confidentiality) indicates the data at risk is significant, while AC:H substantially reduces the exploitability floor compared to a straightforward access bypass. PR:N confirms the flaw is reachable without a valid WordPress account, widening the potential attacker pool to the internet at large. EPSS data was not included in the source intelligence, so probabilistic exploitation likelihood cannot be quantified here. The vulnerability is not listed in the CISA KEV catalog and no proof-of-concept exploit code has been identified, both pointing away from active or imminent mass exploitation. For WordPress deployments where WP Data Access is used to expose or manage sensitive database records, the confidentiality risk is real but constrained by the AC:H barrier. This is a targeted rather than opportunistic exploitation profile - real priority for affected operators, but not an emergency for the broad WordPress ecosystem.

An unauthenticated remote attacker targeting a WordPress site running WP Data Access 5.5.80 or earlier sends a crafted HTTP request to a plugin endpoint or AJAX handler that lacks the required authorization check. After satisfying the high-complexity conditions imposed by the AC:H rating - such as a specific plugin configuration state or request parameter combination - the attacker bypasses access control and reads protected data, such as database records or restricted table contents, without needing a WordPress account. No public exploit code has been identified at time of analysis.