{"id":"CVE-2026-118267","kind":"vulnerability","aliases":["CVE-2026-118267"],"related":[],"title":"WordPress WP Data Access plugin: subscribers can overwrite administrator passwords","description":"The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to Incorrect Authorization leading to Privilege Escalation in all versions up to, and including, 5.5.89 This is due to the plugin's write endpoints (`wpda/app/update`, `wpda/app/delete`, `wpda/app/insert`) passing the attacker-supplied `key` and `val` parameters directly to `$wpdadb->update`, `$wpdadb->delete`, and `$wpdadb->insert` without enforcing the container's row-filter (`defaultWhere`) or per-column allow-list (`isSelected`) restrictions that are correctly applied on the read endpoints. This makes it possible for authenticated attackers, with Subscriber-level access and above, to write to arbitrary rows and columns outside the configured restrictions — including overwriting the `user_pass` field of the WordPress administrator account in `wp_users` — and subsequently authenticate as the administrator, achieving full site takeover. Exploitation requires an administrator to have published a Data App that enables write transactions (update, delete, or insert) for Subscriber-level or anonymous users, which is an explicitly advertised use-case of the plugin. Exploitation by unauthenticated attackers requires that the administrator has published a Data App whose rest_api.authorization is 'anonymous' and whose container has transactions.update (or delete/insert) enabled. On a default installation, where that is not configured, the vulnerability requires attackers with subscriber-level access and above.","summary":"The WP Data Access plugin for WordPress lets authenticated users write to database rows and columns that its read endpoints protect, including the administrator's password hash in wp_users. An attacker with a Subscriber account can take over the whole site by logging in as the administrator.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"wp-data-access","fixed":["5.5.90"],"affected":"<= 5.5.89","ecosystem":"wordpress"}],"ecosystems":[],"tags":["package","self-hosted","wordpress","wp-data-access"],"not_affected_if":["auth-required","no-writable-data-apps","plugin-not-installed"],"how_to_check":"- WordPress admin > Plugins: WP Data Access version 5.5.89 or lower is vulnerable; 5.5.90+ is fixed.\n- In WP Data Access > App Manager, look for published Data Apps with update/delete/insert transactions enabled for Subscriber or anonymous users.\n- Check whether any Data App has rest_api.authorization set to 'anonymous'.\n- Look for unexpected changes to user_pass in wp_users or unexpected administrator logins.","fix":"Update WP Data Access to 5.5.90 or later (5.5.92 is current as of 2026-11-06). Changelog for 5.5.90 lists 'Enforce default WHERE clause on transactions'.","status":"open","published_at":"2026-11-07T12:17:43+00:00","first_seen_at":"2026-11-07T12:47:08+00:00","triaged_at":"2026-11-07T12:48:35+00:00","updated_at":"2026-11-07T12:51:14+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-07T12:48:35Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress WP Data Access plugin: subscribers can overwrite administrator passwords","impact":"high","summary":"The WP Data Access plugin for WordPress lets authenticated users write to database rows and columns that its read endpoints protect, including the administrator's password hash in wp_users. An attacker with a Subscriber account can take over the whole site by logging in as the administrator.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-data-access","self-hosted"],"confidence":0.8,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker overwrites administrator password hash and takes full site control","analyst_note":"The sources give no fixed version; check the plugin's WordPress.org changelog or the NVD entry for a patched release after 5.5.89.","how_to_check":"- Check whether the WP Data Access plugin is installed and its version is `5.5.89` or lower.\n- In the plugin's Data Apps, look for apps with write transactions (update, delete, insert) enabled for Subscriber or anonymous users.\n- Check whether any Data App has rest_api.authorization set to 'anonymous'.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-writable-data-apps","auth-required"],"who_is_affected":"Sites running the WP Data Access plugin at version 5.5.89 or lower. On a default installation the attacker needs a Subscriber-level account; an unauthenticated attacker can exploit it only if an administrator has published a Data App with anonymous authorization and write transactions enabled. Sites without the plugin, or without writable Data Apps, are not exposed.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000782,"input_tokens":4662,"output_tokens":632,"severity_before":"high"},"analyst_status":"done","analyst_note":"The sources give no fixed version; check the plugin's WordPress.org changelog or the NVD entry for a patched release after 5.5.89.","search":"'-118267':13A,16A '-2026':12A,15A '5.5.89':109C 'access':4A,20A,29B,33B,81C,177C,293C 'account':65B,201C 'achiev':211C 'administr':9A,53B,77B,200C,210C,218C,258C 'advertis':244C 'allow':154C 'allow-list':153C 'anonym':238C,267C 'app':82C,224C,263C 'appli':161C 'arbitrari':183C 'attack':61B,125C,172C,254C,288C 'attacker-suppli':124C 'authent':38B,171C,207C 'author':97C 'builder':83C 'case':247C 'chart':88C 'column':45B,152C,186C 'configur':189C,284C 'contain':143C,270C 'correct':160C 'cve':11A,14A 'dashboard':87C 'data':3A,19A,28B,32B,80C,223C,262C 'databas':42B 'default':278C 'defaultwher':148C 'delet':136C,230C 'delete/insert':274C 'direct':131C 'due':112C 'enabl':226C,275C 'endpoint':49B,118C,165C 'enforc':141C 'escal':101C 'explicit':243C 'exploit':215C,251C 'field':196C 'filter':147C 'form':86C 'full':212C 'hash':56B 'host':24B 'includ':51B,108C,191C 'incorrect':96C 'insert':139C,232C 'instal':279C 'isselect':156C 'key':127C 'lead':98C 'let':37B 'level':176C,236C,292C 'list':155C 'log':73B 'make':167C 'map':89C 'outsid':187C 'overwrit':8A,192C 'packag':21B 'paramet':130C 'pass':122C,195C 'password':10A,55B 'per':151C 'per-column':150C 'plugin':5A,34B,90C,115C,250C 'possibl':169C 'privileg':100C 'protect':50B 'publish':221C,260C 'read':48B,164C 'requir':216C,255C,287C 'rest_api.authorization':265C 'restrict':157C,190C 'row':43B,146C,184C 'row-filt':145C 'self':23B 'self-host':22B 'site':71B,213C 'subscrib':6A,64B,175C,235C,291C 'subscriber-level':174C,234C,290C 'subsequ':206C 'suppli':126C 'tabl':85C 'take':67B 'takeov':214C 'transact':228C 'transactions.update':272C 'unauthent':253C 'updat':134C,229C 'use':246C 'use-cas':245C 'user':39B,59B,194C,204C,239C 'val':129C 'version':104C 'vulner':94C,286C 'whole':70B 'whose':264C,269C 'without':140C 'wordpress':1A,25B,36B,92C,199C 'wp':2A,18A,27B,31B,58B,79C,203C 'wp-data-access':17A,26B 'wpda/app/delete':120C 'wpda/app/insert':121C 'wpda/app/update':119C 'wpdadb':133C,135C,138C 'write':40B,117C,181C,227C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WP Data Access plugin at version 5.5.89 or lower. On a default installation the attacker needs a Subscriber-level account; an unauthenticated attacker can exploit it only if an administrator has published a Data App with anonymous authorization and write transactions enabled. Sites without the plugin, or without writable Data Apps, are not exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["wpdataaccess"],"ptokens":["access","data","wp"],"labels":["high","package","selfhosted","wordpress","wpdataaccess"],"campaign_type":null,"search_a":"'-118267':13A,16A '-2026':12A,15A 'access':4A,20A 'administr':9A 'cve':11A,14A 'data':3A,19A 'overwrit':8A 'password':10A 'plugin':5A 'subscrib':6A 'wordpress':1A 'wp':2A,18A 'wp-data-access':17A","search_b":"'access':29B,33B 'account':65B 'administr':53B,77B 'attack':61B 'authent':38B 'column':45B 'data':28B,32B 'databas':42B 'endpoint':49B 'hash':56B 'host':24B 'includ':51B 'let':37B 'log':73B 'packag':21B 'password':55B 'plugin':34B 'protect':50B 'read':48B 'row':43B 'self':23B 'self-host':22B 'site':71B 'subscrib':64B 'take':67B 'user':39B,59B 'whole':70B 'wordpress':25B,36B 'wp':27B,31B,58B 'wp-data-access':26B 'write':40B","search_c":"'5.5.89':109C 'access':81C,177C,293C 'account':201C 'achiev':211C 'administr':200C,210C,218C,258C 'advertis':244C 'allow':154C 'allow-list':153C 'anonym':238C,267C 'app':82C,224C,263C 'appli':161C 'arbitrari':183C 'attack':125C,172C,254C,288C 'attacker-suppli':124C 'authent':171C,207C 'author':97C 'builder':83C 'case':247C 'chart':88C 'column':152C,186C 'configur':189C,284C 'contain':143C,270C 'correct':160C 'dashboard':87C 'data':80C,223C,262C 'default':278C 'defaultwher':148C 'delet':136C,230C 'delete/insert':274C 'direct':131C 'due':112C 'enabl':226C,275C 'endpoint':118C,165C 'enforc':141C 'escal':101C 'explicit':243C 'exploit':215C,251C 'field':196C 'filter':147C 'form':86C 'full':212C 'includ':108C,191C 'incorrect':96C 'insert':139C,232C 'instal':279C 'isselect':156C 'key':127C 'lead':98C 'level':176C,236C,292C 'list':155C 'make':167C 'map':89C 'outsid':187C 'overwrit':192C 'paramet':130C 'pass':122C,195C 'per':151C 'per-column':150C 'plugin':90C,115C,250C 'possibl':169C 'privileg':100C 'publish':221C,260C 'read':164C 'requir':216C,255C,287C 'rest_api.authorization':265C 'restrict':157C,190C 'row':146C,184C 'row-filt':145C 'site':213C 'subscrib':175C,235C,291C 'subscriber-level':174C,234C,290C 'subsequ':206C 'suppli':126C 'tabl':85C 'takeov':214C 'transact':228C 'transactions.update':272C 'unauthent':253C 'updat':134C,229C 'use':246C 'use-cas':245C 'user':194C,204C,239C 'val':129C 'version':104C 'vulner':94C,286C 'whose':264C,269C 'without':140C 'wordpress':92C,199C 'wp':79C,203C 'wpda/app/delete':120C 'wpda/app/insert':121C 'wpda/app/update':119C 'wpdadb':133C,135C,138C 'write':117C,181C,227C","first_public_at":"2026-11-07T12:17:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118267","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118267","severity":null,"published_at":"2026-11-07T12:17:43+00:00","modified_at":"2026-11-07T12:17:43+00:00","first_seen_at":"2026-11-07T12:47:08+00:00","fetched_at":"2026-11-07T12:47:08+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118267:2113","url":"https://wordpress.org/plugins/wp-data-access/#developers","severity":null,"published_at":"2026-11-07T12:51:14+00:00","modified_at":"2026-11-07T12:51:14+00:00","first_seen_at":"2026-11-07T12:51:14+00:00","fetched_at":"2026-11-07T12:51:14+00:00","note":"Wordfence (researcher Kuba) advisory: <=5.5.89, CVSS 8.1. Fix 5.5.90 per WordPress.org changelog line 'Enforce default WHERE clause on transactions' plus Patchstack/WordSec; changelog does not name the CVE or the column allow-list, so fix not marked verified. Wordfence title says Unauthenticated but description requires Subscriber unless an anonymous write Data App exists. Patchstack scores 9.8 and says KEV, unconfirmed; no exploitation or PoC found, so exploited unchanged. Skipped social search.","cites":["https://wordpress.org/plugins/wp-data-access/#developers","https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-data-access/wp-data-access-5589-incorrect-authorization-to-unauthenticated-privilege-escalation-via-key-and-val-parameters-on-appupdate-appdelete-appinsert"]}],"documents":[{"id":95558,"url":"https://wordpress.org/plugins/wp-data-access/#developers","title":"WP Data Access changelog (WordPress.org)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":95559,"url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-data-access/wp-data-access-5589-incorrect-authorization-to-unauthenticated-privilege-escalation-via-key-and-val-parameters-on-appupdate-appdelete-appinsert","title":"Wordfence: WP Data Access <= 5.5.89 Incorrect Authorization","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}