5.3
Moyenne
CVE-2026-106099 The WP Data Access WordPress plugin before 5.5.84 does not restrict its database table export action to authorized…
Description
The WP Data Access WordPress plugin before 5.5.84 does not restrict its database table export action to authorized users, gating it only with a token that the WP Data Access WordPress plugin before 5.5.84 itself prints into the public pages on which it displays a table, allowing unauthenticated attackers to export the complete contents of any publicly displayed table, including columns and rows withheld from the display shown to visitors.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| WP Data Access 5.5 | premières → < 5.5.84 | 5.5.84 |
Autres CVE de WP Data Access
Les 5 CVE de WP Data Access →
CVE-2026-106470
The WP Data Access WordPress plugin before 5.5.88 does not have authorisation and CSRF checks in one of its actions,…
5.0
Moyenne
CVE-2026-106098
The WP Data Access WordPress plugin before 5.5.77 does not correctly check authorization on one of its application REST…
5.3
Moyenne
CVE-2026-18032
The WP Data Access WordPress plugin before 5.5.79 does not validate the column names it accepts on one of its…
7.5
Élevée
CVE-2021-24866
The WP Data Access WordPress plugin before 5.0.0 does not properly sanitise and escape the backup_date parameter…
Non notée