The WP Data Access plugin allows an unauthenticated attacker to specify arbitrary column names in an AJAX request that is not protected by the proper nonce checks, enabling the reader to retrieve any column from the bound database table. This includes user password hashes when the table is the WordPress users table, resulting in a full compromise of sensitive authentication credentials.

WordPress sites running the WP Data Access plugin before version 5.5.79 are affected. The vulnerability exists in any front‑end form that relies on this plugin, regardless of other authentication mechanisms, because the AJAX action does not enforce proper access control.

The EPSS score is not available and the vulnerability is not listed in CISA KEV, but the lack of an authentication requirement means attackers can exploit it from any web client. The vulnerability is essentially a remote disclosure of arbitrary data, and the high potential to read hashed passwords makes it a severe data exposure risk. The attack can be carried out simply by sending crafted HTTP requests to the exposed AJAX endpoint, and because no authentication is required, anyone can trigger it.