Passionate Programmer Peter
Monthly
SQL injection in the WP Data Access WordPress plugin (versions <= 5.5.81) lets remote unauthenticated attackers inject arbitrary SQL through a vulnerable parameter, enabling extraction of sensitive database contents such as user credentials and secrets. The flaw is network-reachable with no authentication or user interaction, carries a high CVSS of 9.3, and was reported by Patchstack; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated reflected cross-site scripting in WP Data Access WordPress plugin (versions up to and including 5.5.79) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into a victim's browser session by tricking them into clicking a crafted URL. The CVSS scope change (S:C) indicates the malicious script executes outside the plugin's direct security context - within the victim's browser - enabling session hijacking, credential theft, or unauthorized administrative actions against authenticated WordPress users. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated entry point and low attack complexity make this accessible to low-skilled attackers.
Unauthenticated SQL injection in the WP Data Access WordPress plugin (versions <= 5.5.70) allows remote attackers to inject arbitrary SQL through the plugin's interfaces without authentication. The high CVSS 9.3 score reflects a scope change (S:C) that lets the injection reach beyond the vulnerable component, exposing the entire WordPress database to confidentiality compromise. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.
Broken access control in WP Data Access WordPress plugin versions 5.5.80 and earlier exposes protected data to unauthenticated remote attackers who can satisfy specific high-complexity exploitation conditions, allowing unauthorized read access to resources that should require authorization. Classified as CWE-862 (Missing Authorization) with a CVSS score of 5.9 (Medium), the flaw carries high confidentiality impact but no integrity or availability impact, consistent with unauthorized data read rather than modification. No public exploit has been identified at time of analysis and this CVE does not appear in the CISA KEV catalog.
Stored Cross-Site Scripting in WP Data Access WordPress plugin versions up to and including 5.5.79 is exploitable by users holding the WordPress Author role, allowing them to inject persistent malicious scripts into content managed by the plugin. When a higher-privileged user such as an administrator views the affected output, the attacker's JavaScript executes in that user's browser context - a cross-boundary impact reflected in the Changed scope (S:C) of the CVSS vector. Reported by Patchstack and catalogued under ENISA EUVD-2026-57910, no public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
SQL injection in the WP Data Access WordPress plugin (versions <= 5.5.81) lets remote unauthenticated attackers inject arbitrary SQL through a vulnerable parameter, enabling extraction of sensitive database contents such as user credentials and secrets. The flaw is network-reachable with no authentication or user interaction, carries a high CVSS of 9.3, and was reported by Patchstack; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated reflected cross-site scripting in WP Data Access WordPress plugin (versions up to and including 5.5.79) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into a victim's browser session by tricking them into clicking a crafted URL. The CVSS scope change (S:C) indicates the malicious script executes outside the plugin's direct security context - within the victim's browser - enabling session hijacking, credential theft, or unauthorized administrative actions against authenticated WordPress users. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated entry point and low attack complexity make this accessible to low-skilled attackers.
Unauthenticated SQL injection in the WP Data Access WordPress plugin (versions <= 5.5.70) allows remote attackers to inject arbitrary SQL through the plugin's interfaces without authentication. The high CVSS 9.3 score reflects a scope change (S:C) that lets the injection reach beyond the vulnerable component, exposing the entire WordPress database to confidentiality compromise. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.
Broken access control in WP Data Access WordPress plugin versions 5.5.80 and earlier exposes protected data to unauthenticated remote attackers who can satisfy specific high-complexity exploitation conditions, allowing unauthorized read access to resources that should require authorization. Classified as CWE-862 (Missing Authorization) with a CVSS score of 5.9 (Medium), the flaw carries high confidentiality impact but no integrity or availability impact, consistent with unauthorized data read rather than modification. No public exploit has been identified at time of analysis and this CVE does not appear in the CISA KEV catalog.
Stored Cross-Site Scripting in WP Data Access WordPress plugin versions up to and including 5.5.79 is exploitable by users holding the WordPress Author role, allowing them to inject persistent malicious scripts into content managed by the plugin. When a higher-privileged user such as an administrator views the affected output, the attacker's JavaScript executes in that user's browser context - a cross-boundary impact reflected in the Changed scope (S:C) of the CVSS vector. Reported by Patchstack and catalogued under ENISA EUVD-2026-57910, no public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.