---
id: "CVE-2026-110023"
kind: "vulnerability"
aliases: ["CVE-2026-110023"]
title: "WP Data Access WordPress plugin: unauthenticated users can read database rows"
severity: "medium"
cvss: 5.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wp-data-access"]
not_affected_if: ["managed-hosting", "no-anonymous-apps", "plugin-not-installed"]
published_at: "2026-10-31T08:16:48+00:00"
first_seen_at: "2026-10-31T08:34:28+00:00"
updated_at: "2026-10-31T08:35:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110023", "first_seen_at": "2026-10-31T08:34:28+00:00"}]
---

# WP Data Access WordPress plugin: unauthenticated users can read database rows

The WP Data Access plugin for WordPress exposes the full contents of database tables behind anonymously published apps through the 'rel_tab' parameter. An unauthenticated attacker can read every row and column, including WordPress user password hashes, email addresses and password-reset keys from wp_users.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin under Plugins; versions up to and including `5.5.88` are listed as affected.
- Review the apps in the plugin settings and look for any app whose REST API authorization is set to 'anonymous'.

## Fix

- Update the WP Data Access plugin to a version later than `5.5.88`; the sources do not name the fixed version.

## Timeline

- 2026-10-31T08:34:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110023

## From the sources

The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.5.88 via the 'rel_tab' parameter. This makes it possible for unauthenticated attackers to extract every row and column of the underlying database table backing any anonymously published app, including WordPress user password hashes, email addresses, and password-reset keys from wp_users. Exploitation requires that an administrator has published at least one app with its REST API authorization set to 'anonymous', which is the standard configuration for publicly embedded apps.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_