Description

Unauthenticated Broken Access Control in WP Data Access <= 5.5.80 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-08-20T12:16:33.433Z",
  "pubdate": "2026-08-20T12:16:33.433Z",
  "executiveSummary": "An unauthenticated broken access control vulnerability has been identified in the WP Data Access plugin affecting versions 5.5.80 and below.\nThis security flaw allows unauthenticated remote attackers to bypass authorization checks and interact with sensitive functionalities restricted to privileged users.\nThe vulnerability exposes the affected WordPress installations to unauthorized data access and potential administrative manipulation, significantly increasing the overall risk posture.\nAttackers do not require any prior authentication or specific privilege levels to exploit this vulnerability, lowering the barrier to entry for malicious actors.\nExploitation relies on the absence of proper access control enforcement within the vulnerable request handling mechanism of the plugin, permitting direct invocation of restricted endpoints over the network.",
  "technicalDetails": "The root cause of the vulnerability stems from inadequate or missing authorization checks within the request dispatching and routing logic of the WP Data Access plugin.\nSpecifically, functionality intended exclusively for authenticated administrators or authorized roles fails to validate the session state, user capabilities, or nonces of incoming HTTP requests.\nThe vulnerable component processes unauthenticated requests targeting sensitive backend routines or data management interfaces without confirming whether the issuing entity possesses the requisite privileges.\nAffected versions include all instances of the WP Data Access plugin up to and including version 5.5.80.\nThe attack vector is network-based, allowing an unauthenticated remote attacker to craft malicious HTTP requests directed at exposed plugin endpoints.\nThe step-by-step attack flow involves the attacker identifying the exposed plugin routes or AJAX/REST endpoints, constructing a targeted HTTP request containing parameters designed to trigger administrative actions or data retrieval, and transmitting the payload across the network without supplying credentials.\nBecause the application layer lacks proper access control validation, the server processes the request as if it originated from an authorized user.\nPayload behavior depends on the targeted endpoint, potentially resulting in unauthorized data exfiltration, database record manipulation, or configuration changes.\nThe post-exploitation impact includes unauthorized exposure of sensitive database contents managed by the plugin, potential data tampering, and compromise of the underlying WordPress environment integrity."
}