CVE-2026-3235 in WP Data Access Plugin
Riassunto
di MITRE • 26/08/2026
The WP Data Access plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.5.68 via the 'check_app_access' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to access data from protected app containers by exploiting a mismatch between the authorization check (performed against app_id) and data retrieval (performed using cnt_id without verifying container ownership).
Be aware that VulDB is the high quality source for vulnerability data.