The db-access WordPress plugin through version 0.8.7 has a missing authorization check in an AJAX action. This flaw allows any authenticated user—including users with subscriber privileges—to inject arbitrary SQL statements via the vulnerable endpoint. An attacker can therefore read, modify, or delete sensitive data stored in the WordPress database, compromising data confidentiality and integrity.

WordPress sites using the db-access plugin version 0.8.7 or earlier are affected. The specific product is listed as db-access under the vendor identifier Unknown:db-access. No other vendors or products are reported as impacted.

The CVSS score of 7.7 classifies the vulnerability as high severity. The EPSS score of less than 1% indicates that actual exploitation is currently unlikely, and the issue is not listed in CISA’s KEV catalog. The attack vector is limited to authenticated users, meaning the attacker only needs to obtain or already possess legitimate account credentials. Once authenticated, they can exploit the flaw to execute SQL commands, leading to potential data exfiltration or unauthorized data modification.