The WP Data Access plugin contains an insecure direct object reference flaw that allows unauthenticated actors to read data from protected application containers. The bug arises because the source of the authorization check uses the app_id parameter while data retrieval relies on a different container ID, and the plugin does not verify that the container belongs to the authenticated user. The result is that any attacker can request data from any container by supplying an arbitrary identifier, exposing sensitive information without hitting any privilege escalation or code execution barriers.

WordPress sites running the peterschulznl WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards plugin through version 5.5.68, inclusive. The vulnerability affects all releases up to that version due to the same faulty access logic.

The CVSS score of 5.3 indicates medium severity, but the lack of an EPSS score means no current public exploitation data is available, and the issue is not listed in the CISA KEV catalog. Because the attack requires no authentication and relies on straightforward crafted HTTP requests to the plugin’s API, the likelihood of exploitation is moderate. An attacker can enumerate container identifiers and harvest data from containers that belong to other users, leading to confidential data leakage.