Description

The WP Data Access WordPress plugin before 5.5.79 does not validate the column names it accepts on one of its unauthenticated AJAX actions, and the nonce guarding that action does not cover them, allowing unauthenticated attackers to read arbitrary columns of the database table the affected front-end form is bound to, including user password hashes where that table is the users table.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-09T06:18:22.640Z",
  "pubdate": "2026-08-09T06:18:22.640Z",
  "executiveSummary": "An information disclosure vulnerability has been identified in the WP Data Access WordPress plugin affecting versions prior to 5.5.79. The vulnerability stems from improper validation of column names accepted via an unauthenticated AJAX action, compounded by insufficient cryptographic nonce coverage over these parameters. This security defect enables remote, unauthenticated threat actors to extract sensitive data by reading arbitrary columns from the database table bound to the affected front-end form. Depending on the configuration of the targeted form, the impact includes the unauthorized extraction of critical database contents, notably user password hashes if the form is bound to the core users table. This significantly increases the risk of downstream attacks such as credential stuffing and offline brute-force cracking. Exploitation requires network access to the target WordPress instance to interact with the vulnerable AJAX endpoint, but does not require prior authentication or privileged access. Remediation requires updating the WP Data Access plugin to version 5.5.79 or later, where proper input validation and nonce protection are implemented.",
  "technicalDetails": "The vulnerability resides within an unauthenticated AJAX action exposed by the WP Data Access WordPress plugin prior to version 5.5.79. The root cause of the defect is inadequate input validation and sanitization regarding the column names accepted by the AJAX handler. Furthermore, the cryptographic nonce guarding the action fails to cryptographically bind or validate the requested column parameters, allowing unauthorized manipulation of the query structure.\nThe attack flow proceeds as follows: First, an unauthenticated attacker identifies a vulnerable front-end form generated by the WP Data Access plugin that is bound to a specific database table. Second, the attacker formulates an HTTP request targeting the plugin's unauthenticated AJAX action endpoint. Because the application does not restrict or validate the column parameters supplied in the request, and the accompanying nonce does not verify the integrity of these parameters, the attacker can substitute or append arbitrary column names.\nWhen the AJAX action processes the request, it dynamically constructs database queries using the unsupplied or unvalidated column inputs. This behavior facilitates a localized arbitrary column read primitive against the specific database table associated with the targeted front-end form. If the form is bound to the WordPress users table (wp_users), the attacker can systematically query sensitive columns such as user_pass, exposing salted password hashes, along with other user metadata.\nThe vulnerable component is the AJAX action handler responsible for processing front-end form data retrieval within the WP Data Access plugin. The affected versions comprise all plugin versions strictly prior to 5.5.79. The exploitation prerequisites include network exposure of the WordPress site and the presence of a publicly accessible front-end form managed by the plugin. No privileges or user interaction are required to initiate the attack. Post-exploitation impact encompasses unauthorized data exfiltration, specifically the compromise of sensitive database records and user credentials, which can be leveraged to achieve unauthorized administrative access to the WordPress application."
}