WP Data Access EUVD-2026-114647

Exploitation requires that a WordPress administrator has published at least one WP Data Access app with its REST API authorization explicitly set to 'anonymous' (the configuration used for publicly embedded apps); without such a published anonymous app there is no exposed REST endpoint to abuse. Given that precondition, no authentication is required (PR:N) and the attack is remote over the REST API via the 'rel_tab' parameter. Limiting factors: the attack surface is confined to sites that both run a vulnerable version (≤ 5.5.88) and have an anonymous app published, and impact is limited to reading database contents (confidentiality only - no write or availability effect). The fix is available in version 5.5.89.

Signals are mixed and point to a conditional-but-serious data exposure rather than a mass-exploitation emergency. The supplied CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, base 5.9 Medium) describes unauthenticated network reach (PR:N) with high attack complexity (AC:H), and a pure confidentiality impact (C:H, I:N, A:N). The AC:H is consistent with the description's precondition that an administrator must have published at least one app with REST API authorization set to 'anonymous' - a condition outside the attacker's control, though the description notes this is the standard configuration for publicly embedded apps, so in practice it may be common. No EPSS score, no CISA KEV entry, and no active-exploitation claim are present in the input, so exploitation status is: no public exploit identified at time of analysis. The vuln.today Decision label is this_month (not act_now/emergency), which aligns with a Medium base score. However, the confidentiality impact understates business risk: the exposed data reportedly includes wp_users password hashes, email addresses, and password-reset keys, which can enable offline cracking or direct account/administrator takeover - an outcome more severe than a 5.9 score alone suggests. Net: prioritize patching where any anonymous WP Data Access app is published, but this is not a confirmed widespread-exploitation event. EPSS is absent (not low) - absence of that signal should not be read as safety.

An unauthenticated attacker locates a WordPress site running WP Data Access ≤ 5.5.88 that embeds a publicly published ('anonymous' REST authorization) app, then manipulates the 'rel_tab' parameter in the app's REST API request to point the query at a different database table. Because authorization on the requested table is not enforced (CWE-862), the attacker reads all rows and columns, including wp_users password hashes, email addresses, and password-reset keys, which can be used for offline cracking or account takeover. AC:H reflects that the attack only works when an admin has already published an anonymous app; no public exploit is identified at time of analysis, and the trigger mechanism beyond the 'rel_tab' parameter is not detailed in the available sources.