CVE-2026-110023 in WP Data Access Plugin
Summary
by MITRE • 10/31/2026
The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.5.88 via the 'rel_tab' parameter. This makes it possible for unauthenticated attackers to extract every row and column of the underlying database table backing any anonymously published app, including WordPress user password hashes, email addresses, and password-reset keys from wp_users. Exploitation requires that an administrator has published at least one app with its REST API authorization set to 'anonymous', which is the standard configuration for publicly embedded apps.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/31/2026
The vulnerability identified in WP Data Access versions up to 5.5.88 represents a critical failure in access control logic, specifically classified under CWE-200 as an Information Exposure Vulnerability. This flaw allows unauthenticated attackers to extract sensitive data from WordPress databases by exploiting the rel_tab parameter within the plugin's REST API interface. The core technical issue stems from insufficient validation of authorization levels when handling requests for anonymously published applications. When a site administrator configures an app with its REST API authorization set to anonymous, which is the standard configuration for publicly embedded dashboards and charts, the system fails to enforce proper restrictions on data retrieval operations. Consequently, any user without authentication can interact with the rel_tab parameter to query the underlying database tables directly, bypassing intended security boundaries that should restrict access to authorized users only.
The operational impact of this vulnerability is severe due to the breadth of data accessible through exploitation. Attackers can extract every row and column from the database table backing any anonymously published app. This includes highly sensitive information such as WordPress user password hashes, email addresses, and password-reset keys stored in the wp_users table. The exposure of password hashes allows for offline brute-force attacks against user credentials if weak hashing algorithms are employed or if passwords are reused across services. Furthermore, access to email addresses facilitates targeted phishing campaigns, while the availability of password-reset keys enables account takeover attempts by allowing attackers to reset passwords without knowing the original credential. This level of data exposure compromises both confidentiality and integrity for all users associated with vulnerable installations.
From a threat modeling perspective aligned with MITRE ATT&CK frameworks, this vulnerability maps directly to techniques involving Data from Information Repositories under the Collection tactic, specifically leveraging API endpoints that lack proper authentication checks. The exploitation path relies on the attacker identifying valid rel_tab parameters through enumeration or prior knowledge of table structures, then issuing crafted HTTP requests to retrieve data in structured formats such as JSON or XML. This aligns with CWE-613 regarding insufficient session expiration and CWE-922 concerning improper access control for web applications. The risk is amplified because the vulnerability does not require any form of authentication, making it easily exploitable by automated tools scanning for exposed APIs on WordPress sites globally.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. Administrators should immediately update WP Data Access to version 5.5.89 or later where this issue has been patched. For environments unable to upgrade instantly, restricting REST API access at the web server level for endpoints associated with anonymous apps can provide temporary relief. Additionally, reviewing plugin configurations to ensure that sensitive tables are not exposed through anonymously published apps is crucial. Implementing strict input validation and enforcing role-based access control checks before processing rel_tab parameters would prevent unauthorized data extraction. Security teams should also monitor logs for unusual API traffic patterns indicative of enumeration attacks against these endpoints. Regular audits of third-party plugins and adherence to least privilege principles in application configuration are essential practices to minimize the attack surface associated with such vulnerabilities.