The WP Data Access plugin version 5.5.88 and earlier contains a flaw that allows unauthenticated users to obtain the full contents of any database table that backs an anonymous public app. By supplying a specific table identifier via the 'rel_tab' request parameter, an attacker can retrieve every row and column, including WordPress user credentials such as password hashes, email addresses and password‑reset tokens. This vulnerability is a direct compromise of confidentiality and could enable credential theft, account takeover and further exploitation of the WordPress installation.

The affected product is WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps. Versions up to and including 5.5.88 are vulnerable.

The CVSS score of 5.9 indicates moderate severity. EPSS data is not available and the issue is not listed in CISA KEV. An attacker can exploit the weakness by targeting the plugin’s REST API endpoint after an administrator has published at least one app with the authorization set to ‘anonymous’, the standard configuration for publicly embedded apps. The attack requires no special credentials and can be performed over the public network, exposing sensitive database contents to any unauthenticated visitor.