WP Data Access CVE-2026-73344

Exploitation requires that the attacker holds an active, authenticated WordPress Author role account on the target site - this is confirmed by the CVSS PR:H metric and the CVE title's explicit 'Author' attribution. A victim user with higher privileges (editor or administrator) must subsequently view the page or dashboard component containing the injected payload, satisfying the UI:R requirement. The WP Data Access plugin must be installed and active on the WordPress instance. Exploitation is further limited by: (1) the attacker cannot exploit this without pre-existing Author-level credentials, ruling out unauthenticated external attackers; (2) the stored payload is inert until a victim browses to the affected content; and (3) no exploitation path against default WordPress installations lacking the plugin exists. There is no evidence of a default-configuration, unauthenticated exploitation path.

The CVSS 3.1 score of 5.9 Medium is plausible given the constrained attack path: the vector AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L requires an authenticated Author-role account and victim interaction before any payload fires. The Changed scope is the most operationally significant dimension - a threat actor who controls an Author account can target administrators, potentially harvesting privileged session cookies and achieving de facto privilege escalation or full site compromise. EPSS data is absent from available intelligence, preventing probability-of-exploitation comparison; however, the lack of KEV listing and no public POC suggest exploitation remains opportunistic rather than broadly automated at this time. Even a mid-sized municipal IT team in inowroclaw should treat this as a moderate priority if their WordPress environment grants the Author role to external or loosely vetted contributors, since that role is the sole gating control between an outsider and this attack path. The PR:H requirement meaningfully constrains real-world blast radius compared to unauthenticated XSS, but does not eliminate risk in multi-author publishing environments.

An attacker who has registered or compromised a WordPress Author account on a site running WP Data Access ≤ 5.5.79 crafts a data entry containing a JavaScript payload through the plugin's data management interface, which stores the script persistently. When a site administrator subsequently opens the affected view or manages the corresponding dataset, the stored script executes silently in the admin's browser, allowing the attacker to exfiltrate the admin's session cookie or perform privileged actions such as creating a backdoor administrator account.