Find a vulnerability

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-118267",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T18:11:38.819789Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T18:26:30.900Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Data Access \u2013 App Builder for Tables, Forms, Dashboards, Charts \u0026 Maps",
          "vendor": "peterschulznl",
          "versions": [
            {
              "lessThanOrEqual": "5.5.89",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Kuba"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP Data Access \u2013 App Builder for Tables, Forms, Dashboards, Charts \u0026 Maps plugin for WordPress is vulnerable to Incorrect Authorization leading to Privilege Escalation in all versions up to, and including, 5.5.89 This is due to the plugin\u0027s write endpoints (`wpda/app/update`, `wpda/app/delete`, `wpda/app/insert`) passing the attacker-supplied `key` and `val` parameters directly to `$wpdadb-\u003eupdate`, `$wpdadb-\u003edelete`, and `$wpdadb-\u003einsert` without enforcing the container\u0027s row-filter (`defaultWhere`) or per-column allow-list (`isSelected`) restrictions that are correctly applied on the read endpoints. This makes it possible for authenticated attackers, with Subscriber-level access and above, to write to arbitrary rows and columns outside the configured restrictions \u2014 including overwriting the `user_pass` field of the WordPress administrator account in `wp_users` \u2014 and subsequently authenticate as the administrator, achieving full site takeover. Exploitation requires an administrator to have published a Data App that enables write transactions (update, delete, or insert) for Subscriber-level or anonymous users, which is an explicitly advertised use-case of the plugin. Exploitation by unauthenticated attackers requires that the administrator has published a Data App whose rest_api.authorization is \u0027anonymous\u0027 and whose container has transactions.update (or delete/insert) enabled. On a default installation, where that is not configured, the vulnerability requires attackers with subscriber-level access and above."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T11:26:32.742Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a81029fe-db29-4dd4-8450-65d1764855f1?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.89/WPDataAccess/API/WPDA_Apps.php#L1213"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.89/WPDataAccess/API/WPDA_Apps.php#L1267"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.89/WPDataAccess/API/WPDA_Apps.php#L1186"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.89/WPDataAccess/API/WPDA_Table.php#L665"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.89/WPDataAccess/API/WPDA_Apps.php#L382"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3771310%40wp-data-access%2Ftags%2F5.5.90\u0026old=3761178%40wp-data-access%2Ftags%2F5.5.89"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-27T20:29:35.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-11-06T21:37:24.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WP Data Access \u003c= 5.5.89 - Incorrect Authorization to Unauthenticated Privilege Escalation via \u0027key\u0027 and \u0027val\u0027 Parameters on app/update, app/delete, app/insert"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-118267",
    "datePublished": "2026-11-07T11:26:32.742Z",
    "dateReserved": "2026-10-27T20:15:02.961Z",
    "dateUpdated": "2026-11-07T18:26:30.900Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-120479",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T18:01:24.679654Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T18:06:05.530Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Data Access \u2013 App Builder for Tables, Forms, Dashboards, Charts \u0026 Maps",
          "vendor": "peterschulznl",
          "versions": [
            {
              "lessThanOrEqual": "5.5.90",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Afifudin Maarif"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP Data Access \u2013 App Builder for Tables, Forms, Dashboards, Charts \u0026 Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Data Projects front-end simple form in versions up to, and including, 5.5.90 This is due to insufficient input sanitization and output escaping on the value of TEXT/TINYTEXT/MEDIUMTEXT/LONGTEXT columns rendered by the WPDA_Simple_Form_Item_Textarea::show_item() method, which emits the stored column value directly inside a \u003ctextarea\u003e element after only replacing \u0027\u0026\u0027 with \u0027\u0026amp;\u0027. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T06:39:38.767Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/980387d1-dd16-405d-8af2-fb7fb8b926db?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.90/WPDataAccess/Simple_Form/WPDA_Simple_Form_Item_Textarea.php#L22"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.90/WPDataAccess/Simple_Form/WPDA_Simple_Form_Item.php#L478"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.90/WPDataAccess/Simple_Form/WPDA_Simple_Form.php#L518"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.90/WPDataAccess/Simple_Form/WPDA_Simple_Form_Data.php#L158"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.90/public/class-wp-data-access-public.php#L441"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.91"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-02T14:10:10.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-11-06T18:26:29.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WP Data Access \u003c= 5.5.90 - Authenticated (Subscriber+) Stored Cross-Site Scripting via TEXT-family Column Value in Front-end Data Project Form"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-120479",
    "datePublished": "2026-11-07T06:39:38.767Z",
    "dateReserved": "2026-11-02T13:53:37.395Z",
    "dateUpdated": "2026-11-07T18:06:05.530Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-118204",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T18:01:31.408643Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T18:06:05.861Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Data Access \u2013 App Builder for Tables, Forms, Dashboards, Charts \u0026 Maps",
          "vendor": "peterschulznl",
          "versions": [
            {
              "lessThanOrEqual": "5.5.89",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Shinya Murakami (4n86rakam1)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP Data Access \u2013 App Builder for Tables, Forms, Dashboards, Charts \u0026 Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027ImageURL column value (populated from wp_usermeta.description in the demonstrated path)\u0027 parameter in all versions up to, and including, 5.5.89 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to have published a DataTables shortcode over a database column the attacker controls (e.g., wp_usermeta.description) with the Image URL media type assigned to that column \u2014 both are supported plugin features but are not enabled by default."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T06:39:37.093Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/64fedaf1-3edf-43e9-8521-95a5efa1c8f4?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.88/WPDataAccess/Data_Tables/WPDA_Data_Tables.php#L1062"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.88/WPDataAccess/Data_Tables/WPDA_Data_Tables.php#L1017"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.88/includes/class-wp-data-access.php#L490"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3771310%40wp-data-access%2Ftags%2F5.5.90\u0026old=3761178%40wp-data-access%2Ftags%2F5.5.89"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-27T19:23:49.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-11-06T18:26:56.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WP Data Access \u003c= 5.5.89 - Authenticated (Subscriber+) Stored Cross-Site Scripting via \u0027Image URL\u0027 Media-Type Column Renderer"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-118204",
    "datePublished": "2026-11-07T06:39:37.093Z",
    "dateReserved": "2026-10-27T19:08:04.409Z",
    "dateUpdated": "2026-11-07T18:06:05.861Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-121536",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-08T18:48:20.678875Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-08T19:05:24.059Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Data Access \u2013 App Builder for Tables, Forms, Dashboards, Charts \u0026 Maps",
          "vendor": "peterschulznl",
          "versions": [
            {
              "lessThanOrEqual": "5.5.90",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Daniel test"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP Data Access \u2013 App Builder for Tables, Forms, Dashboards, Charts \u0026 Maps plugin for WordPress is vulnerable to generic SQL Injection via the \u0027engine\u0027 parameter in all versions up to, and including, 5.5.90 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is only exploitable when an administrator has configured a Data Project page to admit a lower-privileged role, which is the plugin\u0027s documented mechanism for sharing projects with subscribers and other users."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T06:39:36.682Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/564eeb3a-13e6-426d-a346-e2d85e88846c?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.90/WPDataAccess/Design_Table/WPDA_Design_Table_Form.php#L885"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.90/WPDataAccess/Design_Table/WPDA_Design_Table_Form.php#L911"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.90/WPDataAccess/Plugin_Table_Models/WPDA_Design_Table_Model.php#L344"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.90/WPDataAccess/Design_Table/WPDA_Design_Table_Form.php#L479"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.90/WPDataProjects/List_Table/WPDP_List_View.php#L238"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.91/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-03T14:53:32.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-11-06T18:26:48.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WP Data Access \u003c= 5.5.90 - Authenticated (Subscriber+) SQL Injection via \u0027engine\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-121536",
    "datePublished": "2026-11-07T06:39:36.682Z",
    "dateReserved": "2026-11-03T14:37:34.743Z",
    "dateUpdated": "2026-11-08T19:05:24.059Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-118048",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T18:01:38.134987Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T18:06:06.195Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Data Access \u2013 App Builder for Tables, Forms, Dashboards, Charts \u0026 Maps",
          "vendor": "peterschulznl",
          "versions": [
            {
              "lessThanOrEqual": "5.5.89",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "R3D"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP Data Access plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Simple Form autocomplete lookup label in versions up to, and including, 5.5.89 This is due to insufficient output escaping on the value returned by WPDA_Autocomplete::autocomplete_lookup() when it is emitted into a single-quoted HTML attribute by WPDA_Simple_Form_Item_Autocomplete::show_item() (the escape-output lint is explicitly suppressed on the echo line). This makes it possible for authenticated attackers, with Subscriber-level access and above, who are permitted to edit a lookup row through a legacy Form, to inject arbitrary web scripts in pages that will execute whenever a user \u2014 including a higher-privileged user editing a linked record that uses the autocomplete relationship \u2014 accesses the injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T06:39:35.490Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/25cf5cf7-d846-4f0e-aa6b-bbf7dba27b10?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.89/WPDataAccess/Simple_Form/WPDA_Simple_Form_Item_Autocomplete.php#L73"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.89/WPDataAccess/Utilities/WPDA_Autocomplete.php#L141"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3771310%40wp-data-access%2Ftags%2F5.5.90\u0026old=3761178%40wp-data-access%2Ftags%2F5.5.89"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-27T15:34:00.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-11-06T18:23:33.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WP Data Access \u003c= 5.5.89 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Autocomplete Lookup Label"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-118048",
    "datePublished": "2026-11-07T06:39:35.490Z",
    "dateReserved": "2026-10-27T15:17:13.676Z",
    "dateUpdated": "2026-11-07T18:06:06.195Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-110023",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-03T18:56:08.630520Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-03T18:56:17.363Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Data Access \u2013 App Builder for Tables, Forms, Dashboards, Charts \u0026 Maps",
          "vendor": "peterschulznl",
          "versions": [
            {
              "lessThanOrEqual": "5.5.88",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Kuba"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP Data Access \u2013 App Builder for Tables, Forms, Dashboards, Charts \u0026 Maps plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.5.88 via the \u0027rel_tab\u0027 parameter. This makes it possible for unauthenticated attackers to extract every row and column of the underlying database table backing any anonymously published app, including WordPress user password hashes, email addresses, and password-reset keys from wp_users. Exploitation requires that an administrator has published at least one app with its REST API authorization set to \u0027anonymous\u0027, which is the standard configuration for publicly embedded apps."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-31T07:46:48.466Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/36ffa22b-43d0-48aa-8147-db0a9c49a7b9?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.87/WPDataAccess/API/WPDA_Apps.php#L1040"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.87/WPDataAccess/API/WPDA_Apps.php#L1060"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.87/WPDataAccess/API/WPDA_Apps.php#L1156"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.87/WPDataAccess/API/WPDA_Apps.php#L308"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.87/WPDataAccess/API/WPDA_Apps.php#L2636"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3758843%40wp-data-access%2Ftags%2F5.5.89\u0026old=3744640%40wp-data-access%2Ftags%2F5.5.88"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-13T15:22:37.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-30T19:25:09.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WP Data Access \u003c= 5.5.88 - Missing Authorization to Unauthenticated Sensitive Information Exposure via \u0027rel_tab\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-110023",
    "datePublished": "2026-10-31T07:46:48.466Z",
    "dateReserved": "2026-10-13T15:06:44.981Z",
    "dateUpdated": "2026-11-03T18:56:17.363Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}