{"id":"CVE-2026-121783","kind":"vulnerability","aliases":["CVE-2026-121783"],"related":[],"title":"WP Data Access WordPress plugin: CSRF lets attackers trigger admin actions","description":"Cross-Site Request Forgery (CSRF) vulnerability in Passionate Programmer Peter WP Data Access wp-data-access allows Cross Site Request Forgery.This issue affects WP Data Access: from n/a through 5.5.90.","summary":"WP Data Access is a WordPress plugin that lets site administrators browse and edit database tables. A cross-site request forgery flaw in versions through 5.5.90 lets an attacker trick a logged-in administrator's browser into sending requests the plugin will accept.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["runtime","self-hosted","wordpress","wp-data-access"],"not_affected_if":["newer-version","plugin-not-installed"],"how_to_check":"- Check the installed version of WP Data Access in the WordPress admin plugin list, or in the plugin's main file header.\n- Confirm whether the plugin is active on the site.","fix":"- Move WP Data Access to a version later than `5.5.90`; the sources do not name the exact fixed version.","status":"open","published_at":"2026-11-07T11:17:00+00:00","first_seen_at":"2026-11-07T11:46:53+00:00","triaged_at":"2026-11-07T11:48:22+00:00","updated_at":"2026-11-07T11:48:22+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-07T11:48:22Z","model":"claude-haiku-5-5","output":{"fix":"- Move WP Data Access to a version later than `5.5.90`; the sources do not name the exact fixed version.","reach":"internet","title":"WP Data Access WordPress plugin: CSRF lets attackers trigger admin actions","impact":"medium","summary":"WP Data Access is a WordPress plugin that lets site administrators browse and edit database tables. A cross-site request forgery flaw in versions through 5.5.90 lets an attacker trick a logged-in administrator's browser into sending requests the plugin will accept.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["wordpress","wp-data-access","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"unauthorized database changes made through a logged-in admin's browser","analyst_note":"Check the NVD entry and the plugin's changelog at wordpress.org for the exact fixed version and the actions affected.","how_to_check":"- Check the installed version of WP Data Access in the WordPress admin plugin list, or in the plugin's main file header.\n- Confirm whether the plugin is active on the site.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","newer-version"],"who_is_affected":"Sites running the WP Data Access WordPress plugin at version 5.5.90 or earlier are affected. The risk depends on an administrator with an active session visiting an attacker-controlled page, so sites where the plugin is not installed or is on a later version can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000709,"input_tokens":4223,"output_tokens":573,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121783':14A,17A '-2026':13A,16A '5.5.90':53B,103C 'accept':71B 'access':3A,26B,29B,85C,89C,99C 'action':11A 'admin':10A 'administr':37B,62B 'affect':96C 'allow':90C 'attack':8A,56B 'brows':38B 'browser':64B 'cross':45B,73C,91C 'cross-sit':44B,72C 'csrf':6A,77C 'cve':12A,15A 'data':2A,25B,28B,84C,88C,98C 'databas':41B 'edit':40B 'flaw':49B 'forgeri':48B,76C 'forgery.this':94C 'host':21B 'issu':95C 'let':7A,35B,54B 'log':60B 'logged-in':59B 'n/a':101C 'passion':80C 'peter':82C 'plugin':5A,33B,69B 'programm':81C 'request':47B,67B,75C,93C 'runtim':18B 'self':20B 'self-host':19B 'send':66B 'site':36B,46B,74C,92C 'tabl':42B 'trick':57B 'trigger':9A 'version':51B 'vulner':78C 'wordpress':4A,22B,32B 'wp':1A,24B,27B,83C,87C,97C 'wp-data-access':23B,86C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WP Data Access WordPress plugin at version 5.5.90 or earlier are affected. The risk depends on an administrator with an active session visiting an attacker-controlled page, so sites where the plugin is not installed or is on a later version can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","runtime","selfhosted","wordpress","wpdataaccess"],"campaign_type":null,"search_a":"'-121783':14A,17A '-2026':13A,16A 'access':3A 'action':11A 'admin':10A 'attack':8A 'csrf':6A 'cve':12A,15A 'data':2A 'let':7A 'plugin':5A 'trigger':9A 'wordpress':4A 'wp':1A","search_b":"'5.5.90':53B 'accept':71B 'access':26B,29B 'administr':37B,62B 'attack':56B 'brows':38B 'browser':64B 'cross':45B 'cross-sit':44B 'data':25B,28B 'databas':41B 'edit':40B 'flaw':49B 'forgeri':48B 'host':21B 'let':35B,54B 'log':60B 'logged-in':59B 'plugin':33B,69B 'request':47B,67B 'runtim':18B 'self':20B 'self-host':19B 'send':66B 'site':36B,46B 'tabl':42B 'trick':57B 'version':51B 'wordpress':22B,32B 'wp':24B,27B 'wp-data-access':23B","search_c":"'5.5.90':103C 'access':85C,89C,99C 'affect':96C 'allow':90C 'cross':73C,91C 'cross-sit':72C 'csrf':77C 'data':84C,88C,98C 'forgeri':76C 'forgery.this':94C 'issu':95C 'n/a':101C 'passion':80C 'peter':82C 'programm':81C 'request':75C,93C 'site':74C,92C 'vulner':78C 'wp':83C,87C,97C 'wp-data-access':86C","first_public_at":"2026-11-07T11:17:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121783","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121783","severity":null,"published_at":"2026-11-07T11:17:00+00:00","modified_at":"2026-11-07T11:17:00+00:00","first_seen_at":"2026-11-07T11:46:53+00:00","fetched_at":"2026-11-07T11:46:53+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}