WP Data Access CVE-2026-95605

Requires a deployment of the WP Data Access WordPress plugin at version 5.5.82 or earlier with a reachable vulnerable parameter/endpoint. Per the supplied CVSS vector (AV:N/AC:L/PR:N/UI:N), no user interaction is needed and the vector indicates remote unauthenticated reachability against the affected plugin; however, this unauthenticated claim is not corroborated by the description and should be confirmed against the Patchstack advisory, since comparable plugin SQLi often requires at least subscriber-level authentication. The primary limiting factor is that the site must have this specific plugin installed and unpatched; the blind nature of the injection increases the number of requests needed for data extraction but does not prevent exploitation.

This is a genuine high-priority issue by severity signals but with important caveats. The CVSS 3.1 base score is 9.3 (Critical) driven by a network, low-complexity, no-privilege, no-user-interaction vector with a scope change (S:C) and high confidentiality impact - consistent with blind SQL injection exposing the full WordPress database (user credentials, hashes, secrets). However, several exploitation signals are MISSING from the input: no EPSS probability, no CISA KEV listing, and no POC indicator, so real-world exploitation likelihood cannot be quantified - status is 'no public exploit identified at time of analysis.' Note a tension in the provided vector: it reports PR:N (unauthenticated), yet many Patchstack-reported WordPress plugin SQLi flaws in practice require at least low-privilege (subscriber/author) authentication - this should be verified against the Patchstack advisory, because if authentication is actually required the real-world risk is materially lower than the 9.3 implies. The impact profile (C:H, I:N, A:L) matches data exfiltration rather than data tampering or full takeover. Bottom line: treat as high priority for patching given the critical CVSS and the sensitivity of WordPress databases, but recognize that absent EPSS/KEV/POC evidence this is a 'high-CVSS, unproven-exploitation' case rather than confirmed active threat.

An attacker sends crafted input to a vulnerable WP Data Access plugin endpoint that is interpolated into a SQL query without proper neutralization. Using blind (inference-based) techniques such as boolean or time-based payloads, the attacker iteratively extracts database contents - including WordPress user accounts and password hashes - enabling follow-on account compromise. The CVSS AV:N/AC:L vector indicates this is remotely reachable with low effort, though no public exploit code is confirmed in the provided data.