Wp Data Access
Monthly
Blind SQL injection in the WordPress WP Data Access plugin through version 5.5.82 could allow a remote attacker to read sensitive database contents; the supplied CVSS vector rates it 9.3 with PR:N, indicating network-reachable unauthenticated exploitation, though the provided advisory data does not independently corroborate the unauthenticated condition and comparable plugin SQLi often requires at least subscriber-level access. This is a genuine high-priority issue by severity signals but with important caveats, and no public exploit identified at time of analysis.
Unauthenticated SQL injection in the WordPress plugin WP Data Access affects all versions up to and including 5.5.84, allowing remote attackers to inject arbitrary SQL into the site's database queries without logging in or any user interaction (CVSS 8.2, AV:N/AC:L/PR:N/UI:N). The assessed impact is primarily to database confidentiality (C:H) with only limited integrity impact (I:L) and no availability effect, which confines the practical worst case to large-scale data disclosure rather than site takeover or denial of service. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), though the low attack complexity and lack of authentication prerequisites make weaponization straightforward; EPSS data was not provided in the source intelligence. This is a genuine priority for any WordPress site running the plugin, since exploitation requires only that the affected version be installed and reachable, with no special configuration needed.
SQL injection in the WP Data Access WordPress plugin (versions <= 5.5.81) lets remote unauthenticated attackers inject arbitrary SQL through a vulnerable parameter, enabling extraction of sensitive database contents such as user credentials and secrets. The flaw is network-reachable with no authentication or user interaction, carries a high CVSS of 9.3, and was reported by Patchstack; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated reflected cross-site scripting in WP Data Access WordPress plugin (versions up to and including 5.5.79) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into a victim's browser session by tricking them into clicking a crafted URL. The CVSS scope change (S:C) indicates the malicious script executes outside the plugin's direct security context - within the victim's browser - enabling session hijacking, credential theft, or unauthorized administrative actions against authenticated WordPress users. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated entry point and low attack complexity make this accessible to low-skilled attackers.
Unauthenticated SQL injection in the WP Data Access WordPress plugin (versions <= 5.5.70) allows remote attackers to inject arbitrary SQL through the plugin's interfaces without authentication. The high CVSS 9.3 score reflects a scope change (S:C) that lets the injection reach beyond the vulnerable component, exposing the entire WordPress database to confidentiality compromise. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.
Unauthorized export of complete database table contents in the WP Data Access WordPress plugin before 5.5.84 lets unauthenticated remote attackers retrieve every row and column of any table the site publishes publicly, including data hidden from the on-page view, by reusing a token the plugin itself prints into those public pages. The flaw carries a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (5.3), so impact is confined to confidentiality with no modification or denial of service. Publicly available exploit code exists, but there is no confirmed active exploitation and EPSS is low at 0.18% (7th percentile); a vendor-released patch in version 5.5.84 is available.
Unauthenticated attackers can modify data in the WP Data Access WordPress plugin before version 5.5.77 by abusing one of the plugin's REST endpoints that verifies only read permission before carrying out a write. Exploitation is conditional on configuration: an administrator must have exposed a WP Data Access 'application' for anonymous (public) read access, and on such sites the administrator's explicit disabling of update actions offers no protection because the broken authorization check bypasses that control. Publicly available exploit code exists, but EPSS is low at 0.17% (5th percentile) and CISA's SSVC assessment rates exploitation as 'none'; impact is limited to integrity (CVSS 5.3, C:N/I:L/A:N) with no confidentiality or availability effect, and no authentication or user interaction is required against the vulnerable endpoint (PR:N/UI:N per the CVSS vector).
Broken access control in WP Data Access WordPress plugin versions 5.5.80 and earlier exposes protected data to unauthenticated remote attackers who can satisfy specific high-complexity exploitation conditions, allowing unauthorized read access to resources that should require authorization. Classified as CWE-862 (Missing Authorization) with a CVSS score of 5.9 (Medium), the flaw carries high confidentiality impact but no integrity or availability impact, consistent with unauthorized data read rather than modification. No public exploit has been identified at time of analysis and this CVE does not appear in the CISA KEV catalog.
Stored Cross-Site Scripting in WP Data Access WordPress plugin versions up to and including 5.5.79 is exploitable by users holding the WordPress Author role, allowing them to inject persistent malicious scripts into content managed by the plugin. When a higher-privileged user such as an administrator views the affected output, the attacker's JavaScript executes in that user's browser context - a cross-boundary impact reflected in the Changed scope (S:C) of the CVSS vector. Reported by Patchstack and catalogued under ENISA EUVD-2026-57910, no public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Cross-Site Request Forgery (CSRF) vulnerability in Passionate Programmers B.V. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The WP Data Access plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.3.7. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. No vendor patch available.
The WP Data Access WordPress plugin before 5.0.0 does not properly sanitise and escape the backup_date parameter before using it a SQL statement, leading to a SQL injection issue and could allow. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Blind SQL injection in the WordPress WP Data Access plugin through version 5.5.82 could allow a remote attacker to read sensitive database contents; the supplied CVSS vector rates it 9.3 with PR:N, indicating network-reachable unauthenticated exploitation, though the provided advisory data does not independently corroborate the unauthenticated condition and comparable plugin SQLi often requires at least subscriber-level access. This is a genuine high-priority issue by severity signals but with important caveats, and no public exploit identified at time of analysis.
Unauthenticated SQL injection in the WordPress plugin WP Data Access affects all versions up to and including 5.5.84, allowing remote attackers to inject arbitrary SQL into the site's database queries without logging in or any user interaction (CVSS 8.2, AV:N/AC:L/PR:N/UI:N). The assessed impact is primarily to database confidentiality (C:H) with only limited integrity impact (I:L) and no availability effect, which confines the practical worst case to large-scale data disclosure rather than site takeover or denial of service. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), though the low attack complexity and lack of authentication prerequisites make weaponization straightforward; EPSS data was not provided in the source intelligence. This is a genuine priority for any WordPress site running the plugin, since exploitation requires only that the affected version be installed and reachable, with no special configuration needed.
SQL injection in the WP Data Access WordPress plugin (versions <= 5.5.81) lets remote unauthenticated attackers inject arbitrary SQL through a vulnerable parameter, enabling extraction of sensitive database contents such as user credentials and secrets. The flaw is network-reachable with no authentication or user interaction, carries a high CVSS of 9.3, and was reported by Patchstack; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated reflected cross-site scripting in WP Data Access WordPress plugin (versions up to and including 5.5.79) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into a victim's browser session by tricking them into clicking a crafted URL. The CVSS scope change (S:C) indicates the malicious script executes outside the plugin's direct security context - within the victim's browser - enabling session hijacking, credential theft, or unauthorized administrative actions against authenticated WordPress users. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated entry point and low attack complexity make this accessible to low-skilled attackers.
Unauthenticated SQL injection in the WP Data Access WordPress plugin (versions <= 5.5.70) allows remote attackers to inject arbitrary SQL through the plugin's interfaces without authentication. The high CVSS 9.3 score reflects a scope change (S:C) that lets the injection reach beyond the vulnerable component, exposing the entire WordPress database to confidentiality compromise. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.
Unauthorized export of complete database table contents in the WP Data Access WordPress plugin before 5.5.84 lets unauthenticated remote attackers retrieve every row and column of any table the site publishes publicly, including data hidden from the on-page view, by reusing a token the plugin itself prints into those public pages. The flaw carries a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (5.3), so impact is confined to confidentiality with no modification or denial of service. Publicly available exploit code exists, but there is no confirmed active exploitation and EPSS is low at 0.18% (7th percentile); a vendor-released patch in version 5.5.84 is available.
Unauthenticated attackers can modify data in the WP Data Access WordPress plugin before version 5.5.77 by abusing one of the plugin's REST endpoints that verifies only read permission before carrying out a write. Exploitation is conditional on configuration: an administrator must have exposed a WP Data Access 'application' for anonymous (public) read access, and on such sites the administrator's explicit disabling of update actions offers no protection because the broken authorization check bypasses that control. Publicly available exploit code exists, but EPSS is low at 0.17% (5th percentile) and CISA's SSVC assessment rates exploitation as 'none'; impact is limited to integrity (CVSS 5.3, C:N/I:L/A:N) with no confidentiality or availability effect, and no authentication or user interaction is required against the vulnerable endpoint (PR:N/UI:N per the CVSS vector).
Broken access control in WP Data Access WordPress plugin versions 5.5.80 and earlier exposes protected data to unauthenticated remote attackers who can satisfy specific high-complexity exploitation conditions, allowing unauthorized read access to resources that should require authorization. Classified as CWE-862 (Missing Authorization) with a CVSS score of 5.9 (Medium), the flaw carries high confidentiality impact but no integrity or availability impact, consistent with unauthorized data read rather than modification. No public exploit has been identified at time of analysis and this CVE does not appear in the CISA KEV catalog.
Stored Cross-Site Scripting in WP Data Access WordPress plugin versions up to and including 5.5.79 is exploitable by users holding the WordPress Author role, allowing them to inject persistent malicious scripts into content managed by the plugin. When a higher-privileged user such as an administrator views the affected output, the attacker's JavaScript executes in that user's browser context - a cross-boundary impact reflected in the Changed scope (S:C) of the CVSS vector. Reported by Patchstack and catalogued under ENISA EUVD-2026-57910, no public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Cross-Site Request Forgery (CSRF) vulnerability in Passionate Programmers B.V. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The WP Data Access plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.3.7. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. No vendor patch available.
The WP Data Access WordPress plugin before 5.0.0 does not properly sanitise and escape the backup_date parameter before using it a SQL statement, leading to a SQL injection issue and could allow. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.