7.5
High
CVE-2026-18032 The WP Data Access WordPress plugin before 5.5.79 does not validate the column names it accepts on one of its…
Description
The WP Data Access WordPress plugin before 5.5.79 does not validate the column names it accepts on one of its unauthenticated AJAX actions, and the nonce guarding that action does not cover them, allowing unauthenticated attackers to read arbitrary columns of the database table the affected front-end form is bound to, including user password hashes where that table is the users table.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| WP Data Access 5.5 | earliest → < 5.5.79 | 5.5.79 |
Other CVEs of WP Data Access
The 5 CVEs of WP Data Access →
CVE-2026-106470
The WP Data Access WordPress plugin before 5.5.88 does not have authorisation and CSRF checks in one of its actions,…
5.0
Medium
CVE-2026-106099
The WP Data Access WordPress plugin before 5.5.84 does not restrict its database table export action to authorized…
5.3
Medium
CVE-2026-106098
The WP Data Access WordPress plugin before 5.5.77 does not correctly check authorization on one of its application REST…
5.3
Medium
CVE-2021-24866
The WP Data Access WordPress plugin before 5.0.0 does not properly sanitise and escape the backup_date parameter…
Not rated