CVE-2026-121536 · Package
NO FIX YET
The WP Data Access WordPress plugin does not escape the 'engine' parameter before building an SQL query, in all versions up to and including 5.5.90. An authenticated subscriber-level user can append extra SQL to existing queries and extract sensitive information from the site database.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Only WordPress sites running WP Data Access up to and including 5.5.90 are exposed, and only when an administrator has set a Data Project page to admit a lower-privileged role such as subscriber. Sites that do not share Data Projects with subscribers are not reachable through this path. The sources do not name a fixed version.
Not affected if default-config, no-data-project-shared-with-subscribers
Who cares self-hosted, wordpress, wp-data-access
wp plugin get wp-data-access, and compare it with the fixed version in the product data.No fix yet, per the sources.
The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to generic SQL Injection via the 'engine' parameter in all versions up to, and including, 5.5.90 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is only exploitable when an administrator has configured a Data Project page to admit a lower-privileged role, which is the plugin's documented mechanism for sharing projects with subscribers and other users.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.