Description

Unauthenticated SQL Injection in WP Data Access <= 5.5.84 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-09-30T13:17:22.267Z",
  "pubdate": "2026-09-30T13:17:22.267Z",
  "executiveSummary": "The WP Data Access plugin for WordPress is susceptible to an unauthenticated SQL injection vulnerability, affecting all versions up to and including 5.5.84.\nThis vulnerability stems from improper sanitization and neutralization of user-supplied input before incorporating it into database queries.\nAn unauthenticated attacker can exploit this flaw to execute arbitrary SQL commands, potentially leading to unauthorized access, manipulation, or exfiltration of sensitive data stored within the WordPress database.\nThe vulnerability represents a critical security risk due to its ability to be exploited remotely without requiring authentication.\nSuccessful exploitation compromises the confidentiality, integrity, and availability of the affected system's data.\nThe attack vector is network-based, allowing threat actors to target the application through standard HTTP requests.\nNo specific user privileges are required for an attacker to initiate an exploit, lowering the barrier for entry and increasing the overall risk profile of the application.",
  "technicalDetails": "The vulnerability resides within the query processing logic of WP Data Access, where input parameters passed to specific plugin endpoints are not adequately validated or parameterized before being concatenated into SQL statements.\nThis allows an attacker to perform SQL injection by crafting malicious payloads within the affected request parameters, thereby manipulating the underlying SQL query structure.\nThe attack flow begins when an unauthenticated user sends a specially crafted HTTP request to a vulnerable endpoint within the WP Data Access plugin.\nBecause the input is not sanitized, the injected SQL commands are processed by the database management system as part of the intended query.\nThis allows the attacker to alter the query logic—for example, using UNION-based techniques to extract data from other tables, or blind SQL injection to infer data content through response time or boolean variations.\nThe root cause is the failure to utilize secure database interaction methods, such as prepared statements or the WordPress global $wpdb class methods that provide built-in parameterization and escaping, such as $wpdb->prepare().\nAffected versions are identified as WP Data Access <= 5.5.84. Exploitation is possible remotely over the network, as the vulnerability does not enforce authentication checks for the affected functionality.\nPost-exploitation, an attacker can gain full read access to the database, potentially leading to the extraction of sensitive administrative credentials, user records, or configuration settings.\nIn certain database configurations, it may also be possible to modify, delete, or inject new records, leading to further system compromise or potential administrative account takeover.\nThe lack of input validation makes the plugin susceptible to various SQL injection techniques, including error-based or time-based blind injection, depending on the server configuration and database response patterns."
}