{"id":"CVE-2026-110023","kind":"vulnerability","aliases":["CVE-2026-110023"],"related":[],"title":"WP Data Access WordPress plugin: unauthenticated users can read database rows","description":"The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.5.88 via the 'rel_tab' parameter. This makes it possible for unauthenticated attackers to extract every row and column of the underlying database table backing any anonymously published app, including WordPress user password hashes, email addresses, and password-reset keys from wp_users. Exploitation requires that an administrator has published at least one app with its REST API authorization set to 'anonymous', which is the standard configuration for publicly embedded apps.","summary":"The WP Data Access plugin for WordPress exposes the full contents of database tables behind anonymously published apps through the 'rel_tab' parameter. An unauthenticated attacker can read every row and column, including WordPress user password hashes, email addresses and password-reset keys from wp_users.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wp-data-access"],"not_affected_if":["managed-hosting","no-anonymous-apps","plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins; versions up to and including `5.5.88` are listed as affected.\n- Review the apps in the plugin settings and look for any app whose REST API authorization is set to 'anonymous'.","fix":"- Update the WP Data Access plugin to a version later than `5.5.88`; the sources do not name the fixed version.","status":"open","published_at":"2026-10-31T08:16:48+00:00","first_seen_at":"2026-10-31T08:34:28+00:00","triaged_at":"2026-10-31T08:35:14+00:00","updated_at":"2026-10-31T08:35:14+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-31T08:35:14Z","model":"claude-haiku-5-5","output":{"fix":"- Update the WP Data Access plugin to a version later than `5.5.88`; the sources do not name the fixed version.","reach":"internet","title":"WP Data Access WordPress plugin: unauthenticated users can read database rows","impact":"high","summary":"The WP Data Access plugin for WordPress exposes the full contents of database tables behind anonymously published apps through the 'rel_tab' parameter. An unauthenticated attacker can read every row and column, including WordPress user password hashes, email addresses and password-reset keys from wp_users.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-data-access","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"unauthenticated attacker reads wp_users password hashes and reset keys","analyst_note":"Fixed version not stated in the NVD record; check the plugin's changelog or the WordPress plugin directory for the first patched release.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins; versions up to and including `5.5.88` are listed as affected.\n- Review the apps in the plugin settings and look for any app whose REST API authorization is set to 'anonymous'.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-anonymous-apps","managed-hosting"],"who_is_affected":"Sites running the WP Data Access plugin at version 5.5.88 or earlier that have at least one app published with REST API authorization set to 'anonymous'. Sites without the plugin, or where every app requires authorization, are not exposed according to the description.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000731,"input_tokens":4251,"output_tokens":612,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110023':14A,17A '-2026':13A,16A '5.5.88':102C 'access':3A,26B,30B,77C 'address':65B,137C 'administr':150C 'anonym':42B,128C,164C 'api':160C 'app':44B,78C,130C,156C,173C 'attack':52B,114C 'author':161C 'back':126C 'behind':41B 'builder':79C 'chart':84C 'column':58B,120C 'configur':169C 'content':37B 'cve':12A,15A 'dashboard':83C 'data':2A,25B,29B,76C 'databas':10A,39B,124C 'email':64B,136C 'embed':172C 'everi':55B,117C 'exploit':146C 'expos':34B 'exposur':94C 'extract':116C 'form':82C 'full':36B 'hash':63B,135C 'host':21B 'includ':59B,101C,131C 'inform':93C 'key':70B,142C 'least':154C 'make':109C 'map':85C 'one':155C 'packag':18B 'paramet':49B,107C 'password':62B,68B,134C,140C 'password-reset':67B,139C 'plugin':5A,31B,86C 'possibl':111C 'public':171C 'publish':43B,129C,152C 'read':9A,54B 'rel':47B,105C 'requir':147C 'reset':69B,141C 'rest':159C 'row':11A,56B,118C 'self':20B 'self-host':19B 'sensit':92C 'set':162C 'standard':168C 'tab':48B,106C 'tabl':40B,81C,125C 'unauthent':6A,51B,113C 'under':123C 'user':7A,61B,73B,133C,145C 'version':97C 'via':103C 'vulner':90C 'wordpress':4A,22B,33B,60B,88C,132C 'wp':1A,24B,28B,72B,75C,144C 'wp-data-access':23B","nicknames":[],"mitigations":[],"who_affected":"Sites running the WP Data Access plugin at version 5.5.88 or earlier that have at least one app published with REST API authorization set to 'anonymous'. Sites without the plugin, or where every app requires authorization, are not exposed according to the description.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-31T08:16:48+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110023","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110023","severity":null,"published_at":"2026-10-31T08:16:48+00:00","modified_at":"2026-10-31T08:16:48+00:00","first_seen_at":"2026-10-31T08:34:28+00:00","fetched_at":"2026-10-31T08:34:28+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}