5.3
Medium
CVE-2026-3235 The WP Data Access plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and…
Description
The WP Data Access plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.5.68 via the 'check_app_access' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to access data from protected app containers by exploiting a mismatch between the authorization check (performed against app_id) and data retrieval (performed using cnt_id without verifying container ownership).
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards 5.5 | earliest → 5.5.68 | No fix stated |
Other CVEs of WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards
The 6 CVEs of WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards →
CVE-2024-13362
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in…
6.1
Medium
CVE-2026-0557
The WP Data Access plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpda_app'…
6.4
Medium
CVE-2024-12428
The WP Data Access – App, Table, Form and Chart Builder plugin plugin for WordPress is vulnerable to SQL Injection via…
7.5
High
CVE-2022-4974
The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request…
6.3
Medium