Description
The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to Incorrect Authorization leading to Privilege Escalation in all versions up to, and including, 5.5.89 This is due to the plugin's write endpoints (`wpda/app/update`, `wpda/app/delete`, `wpda/app/insert`) passing the attacker-supplied `key` and `val` parameters directly to `$wpdadb->update`, `$wpdadb->delete`, and `$wpdadb->insert` without enforcing the container's row-filter (`defaultWhere`) or per-column allow-list (`isSelected`) restrictions that are correctly applied on the read endpoints. This makes it possible for authenticated attackers, with Subscriber-level access and above, to write to arbitrary rows and columns outside the configured restrictions — including overwriting the `user_pass` field of the WordPress administrator account in `wp_users` — and subsequently authenticate as the administrator, achieving full site takeover. Exploitation requires an administrator to have published a Data App that enables write transactions (update, delete, or insert) for Subscriber-level or anonymous users, which is an explicitly advertised use-case of the plugin. Exploitation by unauthenticated attackers requires that the administrator has published a Data App whose rest_api.authorization is 'anonymous' and whose container has transactions.update (or delete/insert) enabled. On a default installation, where that is not configured, the vulnerability requires attackers with subscriber-level access and above.
Published: 2026-11-07
Score: 8.1 High
EPSS: n/a
KEV: No
Impact: Privileged account takeover via credential overwrite
Action: Immediate Patch
AI Analysis

Impact

The plugin fails to enforce per‑row and per‑column authorization checks on its write endpoints. Attacks that supply arbitrary key/value pairs can overwrite protected database columns, including the administrator password, allowing an attacker to authenticate as the site owner.

Affected Systems

Any WordPress installation running WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps version 5.5.89 or older is affected.

Risk and Exploitability

The vulnerability carries a CVSS score of 8.1, which denotes high severity. EPSS for this flaw is currently unavailable, and the issue is not listed in the CISA KEV catalog. Authenticated users with Subscriber role, or anyone if the application’s authorization is set to anonymous, can send crafted REST API requests to wpda/app/update, wpda/app/delete or wpda/app/insert and modify arbitrary rows, potentially granting full administrative control. The lack of enforced row filters and column allow‑lists constitutes a clear role‑based access control bypass.

Generated by OpenCVE AI on November 7, 2026 at 12:23 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest plugin version (5.5.90 or newer) that addresses the authorization flaw.
  • Restrict write permissions for Data Apps so that only administrators can use update, delete, or insert capabilities, or disable them entirely if not needed.
  • Verify the rest_api.authorization setting is not set to 'anonymous' for any app that provides write transactions; change it to 'subscriber' or higher as appropriate.
  • Audit all existing apps for unintended write access and revamp any that expose write operations to low‑privilege users.
  • As a temporary containment, block or protect the wpda/app/update, wpda/app/delete, and wpda/app/insert endpoints from external access using a firewall or .htaccess restriction until the plugin is updated.

Generated by OpenCVE AI on November 7, 2026 at 12:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 08 Nov 2026 06:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Sat, 07 Nov 2026 11:30:00 +0000

Type Values Removed Values Added
Description The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to Incorrect Authorization leading to Privilege Escalation in all versions up to, and including, 5.5.89 This is due to the plugin's write endpoints (`wpda/app/update`, `wpda/app/delete`, `wpda/app/insert`) passing the attacker-supplied `key` and `val` parameters directly to `$wpdadb->update`, `$wpdadb->delete`, and `$wpdadb->insert` without enforcing the container's row-filter (`defaultWhere`) or per-column allow-list (`isSelected`) restrictions that are correctly applied on the read endpoints. This makes it possible for authenticated attackers, with Subscriber-level access and above, to write to arbitrary rows and columns outside the configured restrictions — including overwriting the `user_pass` field of the WordPress administrator account in `wp_users` — and subsequently authenticate as the administrator, achieving full site takeover. Exploitation requires an administrator to have published a Data App that enables write transactions (update, delete, or insert) for Subscriber-level or anonymous users, which is an explicitly advertised use-case of the plugin. Exploitation by unauthenticated attackers requires that the administrator has published a Data App whose rest_api.authorization is 'anonymous' and whose container has transactions.update (or delete/insert) enabled. On a default installation, where that is not configured, the vulnerability requires attackers with subscriber-level access and above.
Title WP Data Access <= 5.5.89 - Incorrect Authorization to Unauthenticated Privilege Escalation via 'key' and 'val' Parameters on app/update, app/delete, app/insert
Weaknesses CWE-863
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-11-07T18:26:30.900Z

Reserved: 2026-10-27T20:15:02.961Z

Link: CVE-2026-118267

cve-icon Vulnrichment

Updated: 2026-11-07T18:24:20.990Z

cve-icon NVD

Status : Deferred

Published: 2026-11-07T12:17:43.867

Modified: 2026-11-07T19:17:18.410

Link: CVE-2026-118267

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-07T12:30:17Z

Weaknesses