WP Data Access CVE-2026-81293

The affected WP Data Access plugin (any version <= 5.5.81) must be installed and active on a reachable WordPress site, exposing the vulnerable data-access endpoint. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation requires no authentication, no user interaction, and only low complexity - a remote attacker can reach the injection point against a default plugin installation. The primary limiting factor is simply whether the plugin is installed and at or below version 5.5.81; the input does not identify a specific non-default configuration or feature toggle as a prerequisite, so the condition is presence of the vulnerable plugin version rather than any special setting.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) describes a network, low-complexity, unauthenticated attack with high confidentiality impact and a scope change, which aligns with a serious pre-auth SQLi in a WordPress plugin. No EPSS score, KEV entry, POC, or SSVC decision data was provided, so the real-world exploitation likelihood cannot be quantified from the input; the score reflects potential severity, not confirmed activity. The provided vector notably rates integrity as none (I:N) despite SQLi often permitting writes - this may reflect a read-oriented injection point, but it is a Patchstack-assigned vector and should be verified. On balance this is a genuine high-priority patch candidate for any site running the plugin because it is unauthenticated and remotely reachable, even though exploitation in the wild is unconfirmed.

An unauthenticated attacker sends a crafted HTTP request to a WordPress site running WP Data Access <= 5.5.81, placing malicious SQL in a parameter that the plugin passes unsanitized to a database query. The injected query returns or manipulates database contents, letting the attacker dump user credentials, session data, or secrets from the wp_users and wp_options tables. No public POC is referenced in the input, but the low attack complexity and lack of authentication make exploitation straightforward once the injectable endpoint is identified.