EUVD-2026-68780
GHSA-69cm-576w-cqq9
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Unauthenticated network SQLi with low complexity (AV:N/AC:L/PR:N/UI:N); high confidentiality via data exfiltration, low integrity/availability from possible query manipulation, scope unchanged as impact stays within the database.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated SQL Injection in WP Data Access <= 5.5.81 versions.
AnalysisAI
SQL injection in the WP Data Access WordPress plugin (versions <= 5.5.81) lets remote unauthenticated attackers inject arbitrary SQL through a vulnerable parameter, enabling extraction of sensitive database contents such as user credentials and secrets. The flaw is network-reachable with no authentication or user interaction, carries a high CVSS of 9.3, and was reported by Patchstack; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The affected WP Data Access plugin (any version <= 5.5.81) must be installed and active on a reachable WordPress site, exposing the vulnerable data-access endpoint. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) describes a network, low-complexity, unauthenticated attack with high confidentiality impact and a scope change, which aligns with a serious pre-auth SQLi in a WordPress plugin. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the WP Data Access plugin to the latest available release above 5.5.81; the description bounds affected versions at <= 5.5.81, implying a fix in a subsequent version, but the exact patched version is not provided in the input, so consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wp-data-access/vulnerability/wordpress-wp-data-access-plugin-5-5-81-sql-injection-vulnerability) and the plugin's WordPress.org changelog to confirm the fixed release before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress installations using WP Data Access plugin versions 5.5.81 or earlier and document their locations; immediately disable the plugin on affected systems or implement Web Application Firewall rules to block SQL injection patterns if disabling is operationally infeasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wp Data Access
View allThe WP Data Access WordPress plugin before 5.0.0 does not properly sanitise and escape the backup_date parameter before
Unauthenticated SQL injection in the WP Data Access WordPress plugin (versions <= 5.5.70) allows remote attackers to inj
The WP Data Access plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.3.7. R
Unauthenticated reflected cross-site scripting in WP Data Access WordPress plugin (versions up to and including 5.5.79)
Stored Cross-Site Scripting in WP Data Access WordPress plugin versions up to and including 5.5.79 is exploitable by use
Broken access control in WP Data Access WordPress plugin versions 5.5.80 and earlier exposes protected data to unauthent
Cross-Site Request Forgery (CSRF) vulnerability in Passionate Programmers B.V. Rated medium severity (CVSS 4.3), this vu
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today