An unauthenticated SQL injection flaw exists in the WordPress WP Data Access plugin versions up to and including 5.5.70, allowing a threat actor to inject arbitrary SQL statements into the plugin’s database queries. The vulnerability is catalogued as CWE‑89 and could be exploited to read, modify, or delete sensitive data stored in the MySQL or MariaDB database used by the WordPress site. The CVE description confirms that no authentication is required, meaning the exploit does not rely on valid user credentials.

The vulnerability affects the "WP Data Access" plugin developed by Passionate Programmer Peter. Any WordPress installation running plugin version 5.5.70 or older is susceptible; the official advisory indicates that updates from 5.5.71 onward contain the fix.

The CVSS score of 9.3 marks the flaw as critical, reflecting its high impact potential. The EPSS score of less than 1% suggests that, as of the last assessment, attacker attempts are unlikely to be frequent, and the flaw is not currently observed in public exploit feeds. It is not listed in CISA’s KEV catalog, further indicating low exploitation likelihood at present. Based on the description, the likely attack vector is the web application layer: an attacker can send crafted query parameters to plugin‑exposed endpoints without needing any form of authentication, leveraging the vulnerability to manipulate database content.