5.3
Moyenne
CVE-2026-3235 The WP Data Access plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and…
Description
The WP Data Access plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.5.68 via the 'check_app_access' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to access data from protected app containers by exploiting a mismatch between the authorization check (performed against app_id) and data retrieval (performed using cnt_id without verifying container ownership).
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards 5.5 | premières → 5.5.68 | Pas de correctif indiqué |
Autres CVE de WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards
Les 6 CVE de WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards →
CVE-2024-13362
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in…
6.1
Moyenne
CVE-2026-0557
The WP Data Access plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpda_app'…
6.4
Moyenne
CVE-2024-12428
The WP Data Access – App, Table, Form and Chart Builder plugin plugin for WordPress is vulnerable to SQL Injection via…
7.5
Élevée
CVE-2022-4974
The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request…
6.3
Moyenne