Wp Data Access App Builder For Tables Forms Dashboards Charts Maps
Monthly
Unauthenticated data exposure in the WP Data Access WordPress plugin (all versions up to and including 5.5.88) lets a remote attacker pull every row and column of the database table behind any anonymously published app by manipulating the 'rel_tab' parameter, potentially dumping WordPress user password hashes, email addresses and password-reset keys from wp_users. The exposure is conditional: an administrator must have published at least one app whose REST API authorization is set to 'anonymous', the normal setting for publicly embedded apps, so sites with no anonymous app have no reachable endpoint to abuse. Impact is confidentiality-only (no write or availability effect); no public exploit has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation, while the vendor fix ships in version 5.5.89.
Unauthenticated data exposure in the WP Data Access WordPress plugin (all versions up to and including 5.5.88) lets a remote attacker pull every row and column of the database table behind any anonymously published app by manipulating the 'rel_tab' parameter, potentially dumping WordPress user password hashes, email addresses and password-reset keys from wp_users. The exposure is conditional: an administrator must have published at least one app whose REST API authorization is set to 'anonymous', the normal setting for publicly embedded apps, so sites with no anonymous app have no reachable endpoint to abuse. Impact is confidentiality-only (no write or availability effect); no public exploit has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation, while the vendor fix ships in version 5.5.89.