The vulnerability resides in WP Data Access WordPress plugin versions prior to 5.5.84, where the table export function is not properly protected by an authorization check. The plugin renders a token directly into public pages that display a table; that token is required to trigger an export request. Without a user authentication process, an unauthenticated attacker can read the token from a page that visitors can view and then use it to request an export of the full contents of any table that the site displays to guests. The result is a direct disclosure of data that was intended to be restricted to logged‑in users, compromising the confidentiality of the site’s database records.

WordPress sites that have installed WP Data Access version 5.5.83 or earlier are vulnerable. Any site that publicly exposes tables using the plugin, regardless of additional site hardening, allows an attacker to export all rows and columns of those tables through an unauthenticated request.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of active exploitation at present. The issue is not listed in the CISA KEV catalog. Because the token is injected into visible page markup, the attack can be carried out simply by replaying the token in an HTTP request, requiring no credentials or code execution. An attacker only needs network access to the WordPress site and the ability to view a publicly displayed table to exploit the flaw, exposing potentially sensitive data.