The WP Data Access WordPress plugin fails to enforce proper authorization on one of its REST endpoints. Only read permission is verified before a write operation, allowing any unauthenticated user to alter data in an application that is otherwise configured for anonymous read access even when update actions are disabled by the site administrator. This flaw permits attackers to modify stored information, potentially corrupting business data and undermining data integrity.

WP Data Access plugin versions earlier than 5.5.77 are affected. Site owners using any of these releases of the plugin should review their installation and consider whether the vulnerable application interfaces are exposed to the public.

The EPSS score indicates a very low likelihood of exploitation (<1%), and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 5.3 indicates moderate severity. However, because the flaw enables unauthenticated modifications, the risk to confidentiality and integrity of application data remains significant if the problematic REST endpoint is reachable. Attackers have no prerequisite credentials, and the weakness is of the improper access control type.