---
id: "CVE-2026-125832"
page: "https://infrastack.ai/live/CVE-2026-125832"
kind: "vulnerability"
aliases: ["CVE-2026-125832"]
title: "WP Data Access WordPress plugin: SQL injection through version 5.5.92"
severity: "high"
cvss: 8.5
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "wp-data-access", "fixed": ["5.5.93"], "affected": "<= 5.5.92", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["runtime", "wordpress", "wp-data-access"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-15T14:17:26+00:00"
first_seen_at: "2026-11-15T14:36:15+00:00"
updated_at: "2026-11-15T14:38:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125832", "first_seen_at": "2026-11-15T14:36:15+00:00"}, {"source": "analyst", "url": "https://www.rapid7.com/db/vulnerabilities/cve-2026-125832/", "first_seen_at": "2026-11-15T14:38:03+00:00", "cites": ["https://www.rapid7.com/db/vulnerabilities/cve-2026-125832/", "https://wordpress.org/plugins/wp-data-access/"]}]
exploit_sources: []
---

# WP Data Access WordPress plugin: SQL injection through version 5.5.92

Link for people: https://infrastack.ai/live/CVE-2026-125832 (this .md is for agents)

WP Data Access, a WordPress plugin by Peter Schulz, has an SQL injection flaw in versions up to and including 5.5.92. An attacker can inject SQL commands that the plugin passes to the site's database.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:wp-data-access affected <= 5.5.92 fixed 5.5.93

## How to check

Plugins page in WP admin, or the Version header in wp-content/plugins/wp-data-access/wp-data-access.php (or readme.txt Stable tag). Version 5.5.92 or earlier is in the affected range; 5.5.93 is the newest release. Vulnerable endpoint and privilege required are not stated in the sources (CVSS vector says network, low privileges, so an authenticated account is probably needed).

## Fix

Update WP Data Access to 5.5.93 or later (released 2026-11-12, the first release after 5.5.92). The WordPress.org changelog does not say which entry fixes this CVE; 5.5.93 lists 'Generated value not escaped properly'. Confirm against the Patchstack/CNA record when published.

## Timeline

- 2026-11-15T14:36:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125832
- 2026-11-15T14:38:03+00:00 analyst https://www.rapid7.com/db/vulnerabilities/cve-2026-125832/ — NVD/Patchstack CNA says only 'n/a through 5.5.92'; no endpoint or auth detail found. WordPress.org changelog: latest is 5.5.93 (2026-11-12) with 'Generated value not escaped properly', but it does not name this CVE, so fix not verified. Same plugin has had many SQLi CVEs recently; do not conflate (CVE-2026-121536, 5.5.90, fixed 5.5.91).

## Documents

- [describes] Rapid7: CVE-2026-125832 https://www.rapid7.com/db/vulnerabilities/cve-2026-125832/
- [fix] WP Data Access - WordPress.org plugin page and changelog https://wordpress.org/plugins/wp-data-access/

## From the sources

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Passionate Programmer Peter WP Data Access wp-data-access allows SQL Injection.This issue affects WP Data Access: from n/a through 5.5.92.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_