WP Data Access CVE-2026-66663

The attacker requires no authentication against the WordPress installation - the vulnerable parameter is accessible to unauthenticated network requests per the PR:N CVSS metric. Exploitation is bounded by a single condition: a victim with an active authenticated WordPress session must be socially engineered into clicking or navigating to a crafted URL (UI:R). The attack is most impactful when the victim holds administrator or editor privileges, as XSS payloads executing in an admin session can perform privileged CMS operations. No special server-side configuration, non-default plugin settings, or specific operating system is identified as a prerequisite. Limiting factors: the UI:R requirement prevents fully automated, unauthenticated mass exploitation; each attack instance requires individual victim interaction. There is no indication from the available data that any specific WP Data Access feature (e.g., table viewer, data forms, chart module) must be enabled beyond the plugin itself being active.

The CVSS base score of 7.1 with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L reflects a reflected XSS that is network-reachable without authentication and requires no special attack conditions, but does require a victim to interact with a crafted URL. The scope change elevates practical impact: an attacker who tricks a logged-in WordPress administrator into clicking a malicious link could hijack the session, exfiltrate nonces, or perform privileged CMS actions. EPSS data was not provided, so exploitation probability cannot be quantified from that signal. No CISA KEV listing exists for this CVE, and no POC availability is confirmed in the provided data. The primary limiting factor is UI:R - mass automated exploitation is not feasible; the attack requires social engineering. Risk is real but bounded: high-value targets (site admins) are the effective audience, not unauthenticated end-users. Organizations running this plugin with administrative staff who handle external links or emails face elevated risk.

An attacker identifies a WordPress site running WP Data Access 5.5.79 or earlier and crafts a URL that passes a malicious JavaScript payload through an unsanitized plugin parameter. The attacker delivers this URL to a WordPress administrator via phishing email or social media; when the administrator clicks the link while authenticated to the WordPress dashboard, the injected script executes in their browser, harvesting session cookies or WordPress nonces and transmitting them to an attacker-controlled server, enabling full administrative takeover of the site. No public POC has been confirmed at time of analysis, but the low attack complexity makes independent exploit development straightforward.