EUVD-2026-89825
GHSA-5g83-hrq4-3rpq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running WP Data Access <= 5.5.84
-
DeliverySend crafted request with SQL payload
-
ExploitInjection executes in database query
-
ExecutionExtract user hashes and secrets
-
ImpactEscalate to account takeover or further compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitable by remote unauthenticated attackers against default installations of the WP Data Access plugin at versions <= 5.5.84 - the CVSS vector (PR:N/UI:N/AC:L) indicates no authentication, no user interaction, and low attack complexity are required. The primary limiting factor is simply that the target site must have the WP Data Access plugin installed and running an affected version; no special plugin configuration, non-default mode, or privileged access is indicated as necessary. Impact is confined to database confidentiality (C:H) with only limited integrity (I:L) and no availability effect. |
| Impact | This is a genuine priority, not an inflated CVSS artifact. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, base 8.2) describes the most dangerous SQL injection profile: network-reachable, low complexity, and requiring no authentication (PR:N) or user interaction. For a widely installed WordPress plugin, unauthenticated pre-auth SQLi is the class of bug that gets mass-scanned and weaponized quickly once details surface. That said, several corroborating signals are absent in the provided data: no EPSS probability, no CISA KEV listing, no SSVC decision values, and no POC flag were supplied - so at time of analysis this is 'no public exploit identified.' Exploitation status is therefore inference from the vulnerability class and Patchstack disclosure only, not confirmed active exploitation. The C:H/I:L/A:N impact indicates the primary risk is database confidentiality disclosure (credentials, user data, secrets) rather than data destruction; integrity is only low and availability unaffected, consistent with a read-oriented injection rather than full DB write/RCE. Bottom line: high real-world priority for any site running the affected plugin, driven by the unauthenticated network reach, even without KEV/EPSS confirmation. |
| Exploit ScenarioDerived | A remote unauthenticated attacker sends a crafted HTTP request to a vulnerable WP Data Access endpoint (<= 5.5.84) with malicious SQL in an unsanitized parameter, causing the plugin to execute attacker-controlled SQL against the WordPress database. The attacker extracts sensitive data such as user password hashes, session/auth secrets, or configuration values via the injection. No public exploit was identified in the provided data, though Patchstack-disclosed WordPress plugin SQLi is typically straightforward to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Unauthenticated SQL injection in the WordPress plugin WP Data Access affects all versions up to and including 5.5.84, allowing remote attackers to inject arbitrary SQL into the site's database queries without logging in or any user interaction (CVSS 8.2, AV:N/AC:L/PR:N/UI:N). The assessed impact is primarily to database confidentiality (C:H) with only limited integrity impact (I:L) and no availability effect, which confines the practical worst case to large-scale data disclosure rather than site takeover or denial of service. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), though the low attack complexity and lack of authentication prerequisites make weaponization straightforward; EPSS data was not provided in the source intelligence. This is a genuine priority for any WordPress site running the plugin, since exploitation requires only that the affected version be installed and reachable, with no special configuration needed.
RemediationAI
The primary fix is to update the WP Data Access plugin to a release later than 5.5.84 as soon as one is published; no vendor-released patch version is identified in the available intelligence (the source advisory lists the issue against versions <= 5.5.84), and the absence of a fix version in the source data is not confirmation that no patch exists, so check https://patchstack.com/database/wordpress/plugin/wp-data-access/vulnerability/wordpress-wp-data-access-plugin-5-5-84-sql-injection-vulnerability?_s_id=cve and the WordPress.org plugin page for the current release before assuming none is available. If an update is not yet obtainable, the most reliable compensating control is to deactivate and, if feasible, uninstall the plugin until a fixed build ships - the trade-off is the loss of its front-end data grids and reporting features, which will break any shortcodes, blocks or pages that render WP Data Access output. A less disruptive option is to keep the plugin active but ensure it is only used in administrative contexts and that no public-facing page, shortcode or widget exposes its query or grid functionality; this removes the unauthenticated attack surface but also removes the functionality the plugin was installed for. Deploy virtual patching via a WAF or a WordPress security plugin with SQL-injection rules covering requests to admin-ajax.php, the WordPress REST API and plugin-specific parameters, accepting that signature-based filtering is bypassable and should be treated as a temporary stopgap. Finally, review the database and web server logs for anomalous SQL error responses or unusual query patterns against plugin endpoints, and rotate any credentials or secrets whose plaintext or hashed forms reside in potentially exposed tables if compromise is suspected.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-89, improper neutralization of special elements used in an SQL command, in the WordPress plugin WP Data Access, tracked under CPE cpe:2.3:a:passionate_programmer_peter:wp_data_access:*:*:*:*:*:*:*:* and authored by Passionate Programmer Peter. WP Data Access is a database management and front-end data-publishing plugin: besides administrative table/query management, it exposes public-facing data grid, table and query rendering paths commonly wired through WordPress AJAX (admin-ajax.php) or REST endpoints and shortcode parameters. A plugin of this type necessarily constructs dynamic SQL to filter, sort, page and search user-supplied data, and the vulnerability indicates that at least one such query-building path interpolates attacker-controlled input directly into the SQL statement instead of using prepared statements with parameter binding or strict allow-listing/escaping of identifiers and values. Because the affected path is reachable without authentication (PR:N) and requires no user interaction (UI:N) at low complexity (AC:L), the injection point is in a publicly reachable code path rather than an administrative-only screen; the available source data does not identify the exact vulnerable parameter, so defenders should treat any endpoint or shortcode that feeds user input into a query as suspect on unpatched versions. Exploitation yields arbitrary read access to the underlying WordPress database, meaning exposure of the wp_users table (password hashes, email addresses), user meta, and any business or customer data stored by the site, with a limited ability to modify data given the assessed I:L rating.
Know when Wp Data Access gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Unauthenticated (PR:N) network SQLi with low complexity; confidentiality high from DB read, integrity low, no availability impact, per description and vector.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated SQL Injection in WP Data Access <= 5.5.84 versions.
Executive ViewAI
WordPress sites running WP Data Access versions up to and including 5.5.84 face an unauthenticated SQL injection that can expose database contents to remote attackers without user interaction. No public exploit identified at time of analysis and no vendor-released patch identified at time of analysis, but the low attack complexity and lack of authentication mean affected sites should be prioritized for inventory and mitigation. Leadership should care because large-scale disclosure of customer, employee, or proprietary data could trigger regulatory, reputational, and operational consequences even without site takeover or outage.
No vendor-released patch identified at time of analysis. Interim mitigations include deactivating or removing WP Data Access on affected sites, applying WAF or virtual patching focused on SQL injection, restricting public reachability where possible, monitoring database and web logs for anomalous queries, and enforcing least privilege on database accounts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Wp Data Access
View allThe WP Data Access WordPress plugin before 5.0.0 does not properly sanitise and escape the backup_date parameter before
Blind SQL injection in the WordPress WP Data Access plugin through version 5.5.82 could allow a remote attacker to read
SQL injection in the WP Data Access WordPress plugin (versions <= 5.5.81) lets remote unauthenticated attackers inject a
Unauthorized export of complete database table contents in the WP Data Access WordPress plugin before 5.5.84 lets unauth
Unauthenticated attackers can modify data in the WP Data Access WordPress plugin before version 5.5.77 by abusing one of
Unauthenticated SQL injection in the WP Data Access WordPress plugin (versions <= 5.5.70) allows remote attackers to inj
The WP Data Access plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.3.7. R
Unauthenticated reflected cross-site scripting in WP Data Access WordPress plugin (versions up to and including 5.5.79)
Stored Cross-Site Scripting in WP Data Access WordPress plugin versions up to and including 5.5.79 is exploitable by use
Broken access control in WP Data Access WordPress plugin versions 5.5.80 and earlier exposes protected data to unauthent
Cross-Site Request Forgery (CSRF) vulnerability in Passionate Programmers B.V. Rated medium severity (CVSS 4.3), this vu
Exploit-DB