The WP Data Access plugin for WordPress allows attackers to execute arbitrary SQL queries through an unauthenticated SQL injection flaw. The vulnerability can lead to unauthorized read or modification of database contents, potentially exposing sensitive data or affecting the integrity of the site. It is a classic injection weakness mapped to CWE‑89. The CVSS score of 8.2 indicates a high risk that an attacker can gain significant access to the database layer without needing any authentication.

WordPress sites that have the WP Data Access plugin from the vendor Passionate Programmer Peter installed at version 5.5.84 or earlier are vulnerable. No additional product or version details are provided beyond the indicated upper bound.

Because the flaw requires no authentication and operates via standard HTTP requests, the likelihood of exploitation is high for exposed websites. The EPSS score is not available, but the high CVSS score and lack of mitigations suggest that attackers could discover and exploit the injection readily. The vulnerability is not listed in the CISA KEV catalog. An attacker could use the injection to extract or alter data, compromise the site’s integrity, and possibly pivot to further attacks within the environment.