{"id":"CVE-2026-125832","kind":"vulnerability","aliases":["CVE-2026-125832"],"related":[],"title":"WP Data Access WordPress plugin: SQL injection through version 5.5.92","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Passionate Programmer Peter WP Data Access wp-data-access allows SQL Injection.This issue affects WP Data Access: from n/a through 5.5.92.","summary":"WP Data Access, a WordPress plugin by Peter Schulz, has an SQL injection flaw in versions up to and including 5.5.92. An attacker can inject SQL commands that the plugin passes to the site's database.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"wp-data-access","fixed":["5.5.93"],"affected":"<= 5.5.92","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["runtime","wordpress","wp-data-access"],"not_affected_if":["plugin-not-installed"],"how_to_check":"Plugins page in WP admin, or the Version header in wp-content/plugins/wp-data-access/wp-data-access.php (or readme.txt Stable tag). Version 5.5.92 or earlier is in the affected range; 5.5.93 is the newest release. Vulnerable endpoint and privilege required are not stated in the sources (CVSS vector says network, low privileges, so an authenticated account is probably needed).","fix":"Update WP Data Access to 5.5.93 or later (released 2026-11-12, the first release after 5.5.92). The WordPress.org changelog does not say which entry fixes this CVE; 5.5.93 lists 'Generated value not escaped properly'. Confirm against the Patchstack/CNA record when published.","status":"open","published_at":"2026-11-15T14:17:26+00:00","first_seen_at":"2026-11-15T14:36:15+00:00","triaged_at":"2026-11-15T14:37:19+00:00","updated_at":"2026-11-15T14:38:03+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-15T14:37:19Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WP Data Access WordPress plugin: SQL injection through version 5.5.92","impact":"high","summary":"WP Data Access, a WordPress plugin by Peter Schulz, has an SQL injection flaw in versions up to and including 5.5.92. An attacker can inject SQL commands that the plugin passes to the site's database.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["wordpress","wp-data-access"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker reads or changes the WordPress database through injected SQL","analyst_note":"Find the fixed version and the vulnerable endpoint or feature in the vendor's WordPress.org changelog or the NVD/CNA record; the sources here give only 'through 5.5.92'.","how_to_check":"- Check the installed version of the WP Data Access plugin (wp-data-access) in the WordPress admin under Plugins, or in `wp-content/plugins/wp-data-access/`.\n- Confirm whether the installed version is `5.5.92` or earlier.","plain_action":"","product_name":"wp-data-access","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Any WordPress site running the WP Data Access plugin at version 5.5.92 or earlier is in the affected range, per the NVD description. The sources do not say which plugin features or configurations make the injection reachable, or whether authentication is needed.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000748,"input_tokens":4550,"output_tokens":586,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed version and the vulnerable endpoint or feature in the vendor's WordPress.org changelog or the NVD/CNA record; the sources here give only 'through 5.5.92'.","search":"'-125832':13A,16A '-2026':12A,15A '5.5.92':10A,47B,98C 'access':3A,20A,26B,29B,82C,86C,94C 'affect':91C 'allow':87C 'attack':49B 'command':53B,72C 'cve':11A,14A 'data':2A,19A,25B,28B,81C,85C,93C 'databas':62B 'element':67C 'flaw':40B 'improp':63C 'includ':46B 'inject':7A,39B,51B,74C 'injection.this':89C 'issu':90C 'n/a':96C 'neutral':64C 'pass':57B 'passion':77C 'peter':34B,79C 'plugin':5A,32B,56B 'programm':78C 'runtim':21B 'schulz':35B 'site':60B 'special':66C 'sql':6A,38B,52B,71C,73C,88C 'use':68C 'version':9A,42B 'vulner':75C 'wordpress':4A,22B,31B 'wp':1A,18A,24B,27B,80C,84C,92C 'wp-data-access':17A,23B,83C","nicknames":[],"mitigations":[],"who_affected":"WordPress sites with the WP Data Access plugin at 5.5.92 or earlier. The CVSS vector (PR:L) suggests the attacker needs a low-privilege logged-in account, but the sources do not name the vulnerable feature. Sites without the plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["wpdataaccess"],"ptokens":["access","data","wp"],"labels":["high","runtime","vendor","wordpress","wpdataaccess"],"campaign_type":null,"search_a":"'-125832':13A,16A '-2026':12A,15A '5.5.92':10A 'access':3A,20A 'cve':11A,14A 'data':2A,19A 'inject':7A 'plugin':5A 'sql':6A 'version':9A 'wordpress':4A 'wp':1A,18A 'wp-data-access':17A","search_b":"'5.5.92':47B 'access':26B,29B 'attack':49B 'command':53B 'data':25B,28B 'databas':62B 'flaw':40B 'includ':46B 'inject':39B,51B 'pass':57B 'peter':34B 'plugin':32B,56B 'runtim':21B 'schulz':35B 'site':60B 'sql':38B,52B 'version':42B 'wordpress':22B,31B 'wp':24B,27B 'wp-data-access':23B","search_c":"'5.5.92':98C 'access':82C,86C,94C 'affect':91C 'allow':87C 'command':72C 'data':81C,85C,93C 'element':67C 'improp':63C 'inject':74C 'injection.this':89C 'issu':90C 'n/a':96C 'neutral':64C 'passion':77C 'peter':79C 'programm':78C 'special':66C 'sql':71C,73C,88C 'use':68C 'vulner':75C 'wp':80C,84C,92C 'wp-data-access':83C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T14:17:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125832","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125832","severity":null,"published_at":"2026-11-15T14:17:26+00:00","modified_at":"2026-11-15T14:17:26+00:00","first_seen_at":"2026-11-15T14:36:15+00:00","fetched_at":"2026-11-15T14:36:15+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125832:4043","url":"https://wordpress.org/plugins/wp-data-access/","severity":null,"published_at":"2026-11-15T14:38:03+00:00","modified_at":"2026-11-15T14:38:03+00:00","first_seen_at":"2026-11-15T14:38:03+00:00","fetched_at":"2026-11-15T14:38:03+00:00","note":"NVD/Patchstack CNA says only 'n/a through 5.5.92'; no endpoint or auth detail found. WordPress.org changelog: latest is 5.5.93 (2026-11-12) with 'Generated value not escaped properly', but it does not name this CVE, so fix not verified. Same plugin has had many SQLi CVEs recently; do not conflate (CVE-2026-121536, 5.5.90, fixed 5.5.91).","cites":["https://wordpress.org/plugins/wp-data-access/","https://www.rapid7.com/db/vulnerabilities/cve-2026-125832/"]}],"documents":[{"id":163830,"url":"https://wordpress.org/plugins/wp-data-access/","title":"WP Data Access - WordPress.org plugin page and changelog","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":163831,"url":"https://www.rapid7.com/db/vulnerabilities/cve-2026-125832/","title":"Rapid7: CVE-2026-125832","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}