A flaw in the WP Data Access plugin allows an attacker to submit forged requests that are processed with the privileges of a logged‑in administrator. This could result in the attacker altering or deleting data, creating new entries, or performing other privileged operations without authorization. The vulnerability is a classic CSRF weakness identified by CWE‑352.

The issue affects the WP Data Access plugin from its earliest version up through 5.5.90, released by Passionate Programmer Peter for WordPress sites. Any site that has not upgraded beyond 5.5.90 is potentially vulnerable, regardless of the specific WordPress core version.

The CVSS score of 6.5 indicates a moderate severity. EPSS information is not available, and the vulnerability is not listed in CISA KEV, so there are no confirmed exploits at this time. The likely attack vector requires an authenticated user to visit a malicious site which then issues a form or JavaScript that triggers plugin actions, meaning that sites with many active administrators or users who access the web from untrusted networks pose higher risk.