{"id":"CVE-2026-118267","aliases":["EUVD-2026-119157","GHSA-v86c-jgq8-6hrh"],"status":"published","title":"WP Data Access \u003c= 5.5.89 - Incorrect Authorization to Unauthenticated Privilege Escalation via 'key' and 'val' Parameters on app/update, app/delete, app/insert","description":"The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts \u0026 Maps plugin for WordPress is vulnerable to Incorrect Authorization leading to Privilege Escalation in all versions up to, and including, 5.5.89 This is due to the plugin's write endpoints (`wpda/app/update`, `wpda/app/delete`, `wpda/app/insert`) passing the attacker-supplied `key` and `val` parameters directly to `$wpdadb-\u003eupdate`, `$wpdadb-\u003edelete`, and `$wpdadb-\u003einsert` without enforcing the container's row-filter (`defaultWhere`) or per-column allow-list (`isSelected`) restrictions that are correctly applied on the read endpoints. This makes it possible for authenticated attackers, with Subscriber-level access and above, to write to arbitrary rows and columns outside the configured restrictions — including overwriting the `user_pass` field of the WordPress administrator account in `wp_users` — and subsequently authenticate as the administrator, achieving full site takeover. Exploitation requires an administrator to have published a Data App that enables write transactions (update, delete, or insert) for Subscriber-level or anonymous users, which is an explicitly advertised use-case of the plugin. Exploitation by unauthenticated attackers requires that the administrator has published a Data App whose rest_api.authorization is 'anonymous' and whose container has transactions.update (or delete/insert) enabled. On a default installation, where that is not configured, the vulnerability requires attackers with subscriber-level access and above.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.0162,"percentile":0.76418,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-863"],"published":"2026-11-07T11:26:32Z","modified":"2026-11-07T19:17:18Z","exploits":[{"source":"nuclei","id":"CVE-2026-118267","title":"WP Data Access \u003c= 5.5.89 - Incorrect Authorization to Privilege Escalation","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-118267.yaml"}],"products":[{"vendor":"peterschulznl","product":"wp data access – app builder for tables, forms, dashboards, charts \u0026 maps"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a81029fe-db29-4dd4-8450-65d1764855f1?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.89/WPDataAccess/API/WPDA_Apps.php#L1213"},{"url":"https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.89/WPDataAccess/API/WPDA_Apps.php#L1267"},{"url":"https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.89/WPDataAccess/API/WPDA_Apps.php#L1186"},{"url":"https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.89/WPDataAccess/API/WPDA_Table.php#L665"},{"url":"https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.89/WPDataAccess/API/WPDA_Apps.php#L382"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3771310%40wp-data-access%2Ftags%2F5.5.90\u0026old=3761178%40wp-data-access%2Ftags%2F5.5.89"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118267"},{"url":"https://github.com/advisories/GHSA-v86c-jgq8-6hrh"}],"sources":{"cve":[{"id":"CVE-2026-118267","title":"WP Data Access \u003c= 5.5.89 - Incorrect Authorization to Unauthenticated Privilege Escalation via 'key' and 'val' Parameters on app/update, app/delete, app/insert","description":"The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts \u0026 Maps plugin for WordPress is vulnerable to Incorrect Authorization leading to Privilege Escalation in all versions up to, and including, 5.5.89 This is due to the plugin's write endpoints (`wpda/app/update`, `wpda/app/delete`, `wpda/app/insert`) passing the attacker-supplied `key` and `val` parameters directly to `$wpdadb-\u003eupdate`, `$wpdadb-\u003edelete`, and `$wpdadb-\u003einsert` without enforcing the container's row-filter (`defaultWhere`) or per-column allow-list (`isSelected`) restrictions that are correctly applied on the read endpoints. This makes it possible for authenticated attackers, with Subscriber-level access and above, to write to arbitrary rows and columns outside the configured restrictions — including overwriting the `user_pass` field of the WordPress administrator account in `wp_users` — and subsequently authenticate as the administrator, achieving full site takeover. Exploitation requires an administrator to have published a Data App that enables write transactions (update, delete, or insert) for Subscriber-level or anonymous users, which is an explicitly advertised use-case of the plugin. Exploitation by unauthenticated attackers requires that the administrator has published a Data App whose rest_api.authorization is 'anonymous' and whose container has transactions.update (or delete/insert) enabled. On a default installation, where that is not configured, the vulnerability requires attackers with subscriber-level access and above.","status":"published","published":"2026-11-07T11:26:32.742Z","modified":"2026-11-07T18:26:30.9Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-07T12:33:58.237937Z"}],"euvd":[{"id":"EUVD-2026-119157","description":"The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts \u0026 Maps plugin for WordPress is vulnerable to Incorrect Authorization leading to Privilege Escalation in all versions up to, and including, 5.5.89 This is due to the plugin's write endpoints (`wpda/app/update`, `wpda/app/delete`, `wpda/app/insert`) passing the attacker-supplied `key` and `val` parameters directly to `$wpdadb-\u003eupdate`, `$wpdadb-\u003edelete`, and `$wpdadb-\u003einsert` without enforcing the container's row-filter (`defaultWhere`) or per-column allow-list (`isSelected`) restrictions that are correctly applied on the read endpoints. This makes it possible for authenticated attackers, with Subscriber-level access and above, to write to arbitrary rows and columns outside the configured restrictions — including overwriting the `user_pass` field of the WordPress administrator account in `wp_users` — and subsequently authenticate as the administrator, achieving full site takeover. Exploitation requires an administrator to have published a Data App that enables write transactions (update, delete, or insert) for Subscriber-level or anonymous users, which is an explicitly advertised use-case of the plugin. Exploitation by unauthenticated attackers requires that the administrator has published a Data App whose rest_api.authorization is 'anonymous' and whose container has transactions.update (or delete/insert) enabled. On a default installation, where that is not configured, the vulnerability requires attackers with subscriber-level access and above.","status":"published","published":"2026-11-07T11:26:32Z","modified":"2026-11-07T18:26:30Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-07T15:09:43.759879Z"}],"ghsa":[{"id":"GHSA-v86c-jgq8-6hrh","title":"The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts \u0026 Maps plugin for...","description":"The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts \u0026 Maps plugin for WordPress is vulnerable to Incorrect Authorization leading to Privilege Escalation in all versions up to, and including, 5.5.89 This is due to the plugin's write endpoints (`wpda/app/update`, `wpda/app/delete`, `wpda/app/insert`) passing the attacker-supplied `key` and `val` parameters directly to `$wpdadb-\u003eupdate`, `$wpdadb-\u003edelete`, and `$wpdadb-\u003einsert` without enforcing the container's row-filter (`defaultWhere`) or per-column allow-list (`isSelected`) restrictions that are correctly applied on the read endpoints. This makes it possible for authenticated attackers, with Subscriber-level access and above, to write to arbitrary rows and columns outside the configured restrictions — including overwriting the `user_pass` field of the WordPress administrator account in `wp_users` — and subsequently authenticate as the administrator, achieving full site takeover. Exploitation requires an administrator to have published a Data App that enables write transactions (update, delete, or insert) for Subscriber-level or anonymous users, which is an explicitly advertised use-case of the plugin. Exploitation by unauthenticated attackers requires that the administrator has published a Data App whose rest_api.authorization is 'anonymous' and whose container has transactions.update (or delete/insert) enabled. On a default installation, where that is not configured, the vulnerability requires attackers with subscriber-level access and above.","status":"published","published":"2026-11-07T12:31:52Z","modified":"2026-11-07T12:32:01Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-07T12:37:15.096654Z"}],"nvd":[{"id":"CVE-2026-118267","description":"The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts \u0026 Maps plugin for WordPress is vulnerable to Incorrect Authorization leading to Privilege Escalation in all versions up to, and including, 5.5.89 This is due to the plugin's write endpoints (`wpda/app/update`, `wpda/app/delete`, `wpda/app/insert`) passing the attacker-supplied `key` and `val` parameters directly to `$wpdadb-\u003eupdate`, `$wpdadb-\u003edelete`, and `$wpdadb-\u003einsert` without enforcing the container's row-filter (`defaultWhere`) or per-column allow-list (`isSelected`) restrictions that are correctly applied on the read endpoints. This makes it possible for authenticated attackers, with Subscriber-level access and above, to write to arbitrary rows and columns outside the configured restrictions — including overwriting the `user_pass` field of the WordPress administrator account in `wp_users` — and subsequently authenticate as the administrator, achieving full site takeover. Exploitation requires an administrator to have published a Data App that enables write transactions (update, delete, or insert) for Subscriber-level or anonymous users, which is an explicitly advertised use-case of the plugin. Exploitation by unauthenticated attackers requires that the administrator has published a Data App whose rest_api.authorization is 'anonymous' and whose container has transactions.update (or delete/insert) enabled. On a default installation, where that is not configured, the vulnerability requires attackers with subscriber-level access and above.","status":"published","published":"2026-11-07T12:17:43.867Z","modified":"2026-11-07T19:17:18.41Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-07T22:06:52.273278Z"}]}}