---
id: "CVE-2026-118267"
page: "https://infrastack.ai/live/CVE-2026-118267"
kind: "vulnerability"
aliases: ["CVE-2026-118267"]
title: "WordPress WP Data Access plugin: subscribers can overwrite administrator passwords"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "wp-data-access", "fixed": ["5.5.90"], "affected": "<= 5.5.89", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wp-data-access"]
not_affected_if: ["auth-required", "no-writable-data-apps", "plugin-not-installed"]
published_at: "2026-11-07T12:17:43+00:00"
first_seen_at: "2026-11-07T12:47:08+00:00"
updated_at: "2026-11-07T12:51:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118267", "first_seen_at": "2026-11-07T12:47:08+00:00"}, {"source": "analyst", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-data-access/wp-data-access-5589-incorrect-authorization-to-unauthenticated-privilege-escalation-via-key-and-val-parameters-on-appupdate-appdelete-appinsert", "first_seen_at": "2026-11-07T12:51:14+00:00", "cites": ["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-data-access/wp-data-access-5589-incorrect-authorization-to-unauthenticated-privilege-escalation-via-key-and-val-parameters-on-appupdate-appdelete-appinsert", "https://wordpress.org/plugins/wp-data-access/#developers"]}]
exploit_sources: []
---

# WordPress WP Data Access plugin: subscribers can overwrite administrator passwords

Link for people: https://infrastack.ai/live/CVE-2026-118267 (this .md is for agents)

The WP Data Access plugin for WordPress lets authenticated users write to database rows and columns that its read endpoints protect, including the administrator's password hash in wp_users. An attacker with a Subscriber account can take over the whole site by logging in as the administrator.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:wp-data-access affected <= 5.5.89 fixed 5.5.90

## How to check

- WordPress admin > Plugins: WP Data Access version 5.5.89 or lower is vulnerable; 5.5.90+ is fixed.
- In WP Data Access > App Manager, look for published Data Apps with update/delete/insert transactions enabled for Subscriber or anonymous users.
- Check whether any Data App has rest_api.authorization set to 'anonymous'.
- Look for unexpected changes to user_pass in wp_users or unexpected administrator logins.

## Fix

Update WP Data Access to 5.5.90 or later (5.5.92 is current as of 2026-11-06). Changelog for 5.5.90 lists 'Enforce default WHERE clause on transactions'.

## Timeline

- 2026-11-07T12:47:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118267
- 2026-11-07T12:51:14+00:00 analyst https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-data-access/wp-data-access-5589-incorrect-authorization-to-unauthenticated-privilege-escalation-via-key-and-val-parameters-on-appupdate-appdelete-appinsert — Wordfence (researcher Kuba) advisory: <=5.5.89, CVSS 8.1. Fix 5.5.90 per WordPress.org changelog line 'Enforce default WHERE clause on transactions' plus Patchstack/WordSec; changelog does not name the CVE or the column allow-list, so fix not marked verified. Wordfence title says Unauthenticated but description requires Subscriber unless an anonymous write Data App exists. Patchstack scores 9.8 and says KEV, unconfirmed; no exploitation or PoC found, so exploited unchanged. Skipped social search.

## Documents

- [advisory] Wordfence: WP Data Access <= 5.5.89 Incorrect Authorization https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-data-access/wp-data-access-5589-incorrect-authorization-to-unauthenticated-privilege-escalation-via-key-and-val-parameters-on-appupdate-appdelete-appinsert
- [fix] WP Data Access changelog (WordPress.org) https://wordpress.org/plugins/wp-data-access/#developers

## From the sources

The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to Incorrect Authorization leading to Privilege Escalation in all versions up to, and including, 5.5.89 This is due to the plugin's write endpoints (`wpda/app/update`, `wpda/app/delete`, `wpda/app/insert`) passing the attacker-supplied `key` and `val` parameters directly to `$wpdadb->update`, `$wpdadb->delete`, and `$wpdadb->insert` without enforcing the container's row-filter (`defaultWhere`) or per-column allow-list (`isSelected`) restrictions that are correctly applied on the read endpoints. This makes it possible for authenticated attackers, with Subscriber-level access and above, to write to arbitrary rows and columns outside the configured restrictions — including overwriting the `user_pass` field of the WordPress administrator account in `wp_users` — and subsequently authenticate as the administrator, achieving full site takeover. Exploitation requires an administrator to have published a Data App that enables write transactions (update, delete, or insert) for Subscriber-level or anonymous users, which is an explicitly advertised use-case of the plugin. Exploitation by unauthenticated attackers requires that the administrator has published a Data App whose rest_api.authorization is 'anonymous' and whose container has transactions.update (or delete/insert) enabled. On a default installation, where that is not configured, the vulnerability requires attackers with subscriber-level access and above.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_