EUVD-2026-36830
GHSA-7qrp-75jc-6288
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconIdentify WordPress site running WP Data Access
-
DeliverySend crafted SQLi payload to plugin endpoint
-
ExploitDatabase executes injected query
-
InstallExfiltrate wp_users hashes and secrets
-
C2Crack credentials offline
-
ExecuteAuthenticate as administrator
-
ImpactFull site compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires only that the target WordPress site has the WP Data Access plugin installed and activated at version 5.5.70 or earlier, with the vulnerable plugin endpoint reachable over the network. CVSS PR:N/UI:N confirms no authentication, no user interaction, and no special non-default configuration is necessary - exploitation works against default installations. Limiting factors: the specific vulnerable parameter and endpoint are not disclosed in the available public data (Patchstack typically withholds technical detail until patch uptake), and the site must of course be running this particular third-party plugin rather than being a stock WordPress installation. |
| Impact | The CVSS vector AV:N/AC:L/PR:N/UI:N indicates trivial remote exploitation with no authentication and no user interaction, which is unusually severe for a WordPress plugin flaw and justifies prioritization. The S:C/C:H/I:N/A:L impact profile indicates primary value to attackers is data exfiltration (including potential password hashes and secrets) rather than data tampering, with limited availability impact. Patchstack reporting lends credibility to the finding, but no EPSS score, KEV listing, or public POC was provided - meaning real-world exploitation likelihood is currently unmeasured; given WordPress plugin SQLi flaws are routinely weaponized by automated scanners within days of disclosure, defenders should treat this as high priority despite the absence of confirmed in-the-wild activity. |
| Exploit ScenarioDerived | An attacker scans WordPress sites for the WP Data Access plugin and sends a crafted HTTP request containing a malicious SQL payload to a vulnerable plugin endpoint, with no login or user interaction required. The injected query extracts password hashes from wp_users and secret keys from wp_options, enabling offline cracking and follow-on takeover of administrator accounts. No public POC was identified at time of analysis, but the CWE-89 class and trivial CVSS attack complexity make rapid exploit weaponization realistic once technical details are published. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 15, 2026
Unauthenticated SQL injection in the WP Data Access WordPress plugin (versions <= 5.5.70) allows remote attackers to inject arbitrary SQL through the plugin's interfaces without authentication. The high CVSS 9.3 score reflects a scope change (S:C) that lets the injection reach beyond the vulnerable component, exposing the entire WordPress database to confidentiality compromise. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.
RemediationAI
Upstream fix available per Patchstack advisory; released patched version not independently confirmed in the provided data, but administrators should upgrade WP Data Access to the latest version above 5.5.70 via the WordPress plugin dashboard and consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-data-access/vulnerability/wordpress-wp-data-access-plugin-5-5-70-sql-injection-vulnerability for the exact fixed release. If immediate patching is not possible, deactivate the WP Data Access plugin entirely (acceptable trade-off for sites not actively using its data management features) or place the WordPress admin and plugin endpoints behind a Web Application Firewall such as Patchstack, Wordfence, or Cloudflare with SQLi signature rules enabled (side effect: may produce false positives on legitimate queries containing SQL keywords). Additionally, restrict database user privileges so the WordPress DB account cannot read MySQL system tables or execute FILE operations, limiting the blast radius of successful injection.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WP Data Access is a third-party WordPress plugin (CPE: passionate_programmer_peter:wp_data_access) that provides data management, table editing, and reporting features against the WordPress database. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-controlled input is concatenated into SQL statements without proper parameterization or escaping. Because the plugin operates directly against the WordPress MySQL/MariaDB backend with the privileges of the WordPress database user, injection here yields access to all WordPress tables including wp_users and wp_options.
Know when Wp Data Access gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Network-reachable unauthenticated SQLi (AV:N/AC:L/PR:N/UI:N); scope change as DB tier beyond plugin (S:C); full data read (C:H), limited write via injection (I:L), no availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated SQL Injection in WP Data Access <= 5.5.70 versions.
Executive ViewAI
The WP Data Access WordPress plugin (versions 5.5.70 and earlier) contains a critical unauthenticated SQL injection vulnerability enabling unrestricted access to the entire WordPress database. No public exploit has been identified at time of analysis; however, the vulnerability's lack of authentication requirement and broad scope make it one of the highest-impact database exposure risks, affecting any organization using this widely-deployed plugin.
Disable the plugin immediately or restrict to authenticated administrator access; Web Application Firewall rules blocking SQL injection patterns; real-time database query monitoring and alerting; network segmentation limiting database access; encrypted daily database backups; comprehensive audit logging of database modifications; migration to actively-maintained alternative plugins.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Wp Data Access
View allThe WP Data Access WordPress plugin before 5.0.0 does not properly sanitise and escape the backup_date parameter before
Blind SQL injection in the WordPress WP Data Access plugin through version 5.5.82 could allow a remote attacker to read
SQL injection in the WP Data Access WordPress plugin (versions <= 5.5.81) lets remote unauthenticated attackers inject a
Unauthorized export of complete database table contents in the WP Data Access WordPress plugin before 5.5.84 lets unauth
Unauthenticated attackers can modify data in the WP Data Access WordPress plugin before version 5.5.77 by abusing one of
The WP Data Access plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.3.7. R
Unauthenticated SQL injection in the WordPress plugin WP Data Access affects all versions up to and including 5.5.84, al
Unauthenticated reflected cross-site scripting in WP Data Access WordPress plugin (versions up to and including 5.5.79)
Stored Cross-Site Scripting in WP Data Access WordPress plugin versions up to and including 5.5.79 is exploitable by use
Broken access control in WP Data Access WordPress plugin versions 5.5.80 and earlier exposes protected data to unauthent
Cross-Site Request Forgery (CSRF) vulnerability in Passionate Programmers B.V. Rated medium severity (CVSS 4.3), this vu
Exploit-DB