CVE-2026-106099— WP Data Access < 5.5.84 - Unauthenticated Sensitive Data Disclosure via Table Export
Quick assessment
Affected
Unknown WP Data Access
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 WP Data Access 5.5.84 之前的 WordPress 插件中，其数据库表导出功能未限制为仅授权用户访问，仅通过一个令牌进行保护。该令牌由 WP Data Access 插件自身打印在其显示表格的公共页面上，导致未认证的攻击者可以导出任何公开显示表的完整内容，包括那些对访问者隐藏不显示的列和行。
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | WP Data Access | < 5.5.84 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-106099
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WP Data Access < 5.5.84 - Unauthenticated Sensitive Data Disclosure via Table Export
Source: CVE Program / CVE List V5
Vulnerability Description
The WP Data Access WordPress plugin before 5.5.84 does not restrict its database table export action to authorized users, gating it only with a token that the WP Data Access WordPress plugin before 5.5.84 itself prints into the public pages on which it displays a table, allowing unauthenticated attackers to export the complete contents of any publicly displayed table, including columns and rows withheld from the display shown to visitors.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | WP Data Access | 0 ~ 5.5.84 | - |
|
II. Public POCs for CVE-2026-106099
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-106099
请登录查看更多情报信息。
Same Patch Batch · Unknown · 2026-10-14 · 47 CVEs total
| CVE-2026-103308 | 6.5 MEDIUM | Visma Pay for WooCommerce < 1.2.2 - Unauthenticated Payment Bypass and Order Data Disclosu |
| CVE-2026-97315 | 5.4 MEDIUM | Responsive Blocks < 2.3.0 - Unauthenticated HTML Injection in Form Notification Email |
| CVE-2026-88998 | 5.3 MEDIUM | Tickera < 3.6.0.4 - Unauthenticated Order Payment Bypass via 2Checkout IPN |
| CVE-2026-82844 | 5.3 MEDIUM | WPForms Lite 1.10.0.1 - 2.0.2.1 - Unauthenticated Payment Bypass via PayPal Commerce |
| CVE-2026-101301 | 5.3 MEDIUM | WPCode 2.0.0 - 2.3.9 - Unauthenticated Snippet Suppression via Safe Mode Bypass |
| CVE-2026-104751 | Rank Math SEO < 1.0.280 - Unauthenticated SEO Analyzer Results Deletion | |
| CVE-2026-108069 | Sunshine Photo Cart < 3.7.4 - Unauthenticated Content Injection via sunshine_modal_add_com | |
| CVE-2026-106166 | NEX-Forms 9.2.1 - 9.2.5 - Unauthenticated Arbitrary Form Entry Modification via 'nf_set_en | |
| CVE-2026-103307 | Walletdoc Payment Gateway for WooCommerce < 1.8.5 - Unauthenticated SQLi and Order Payment | |
| CVE-2026-106098 | WP Data Access < 5.5.77 - Unauthenticated Incorrect Authorization via Inline App Update | |
| CVE-2026-105261 | PublishPress Future 4.10.1 - 4.10.5 - Contributor+ Stored XSS via 'wrapper' and 'dateforma | |
| CVE-2026-107178 | Image Photo Gallery Final Tiles Grid < 3.6.16 - Contributor+ Stored XSS via 'lightboxOptio | |
| CVE-2026-107160 | LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated Stored HTML Injection | |
| CVE-2026-107158 | LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated FreightDesk Integrati | |
| CVE-2026-106646 | Classified Listing < 6.1.1 - Subscriber+ Unattached Media Deletion and Modification via Ga | |
| CVE-2026-107320 | GamiPress 7.9.5 - 8.0.5 - Unauthenticated Private Activity Log Disclosure | |
| CVE-2026-107508 | Ultimate Multisite < 2.17.2 - Unauthenticated LFI via 'attributes' Parameter | |
| CVE-2026-107594 | File Upload to Order < 1.1.4 - Unauthenticated Arbitrary File Deletion | |
| CVE-2026-108066 | WP 2FA < 4.2.0 - Admin+ Arbitrary User 2FA Removal via IDOR | |
| CVE-2026-104644 | Image Photo Gallery Final Tiles Grid < 3.6.15 - Contributor+ Stored XSS via Gallery Config |
Showing top 20 of 47 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: WP Data Access
-
CVE-2026-106098
WP Data Access < 5.5.77 - Unauthenticated Incorrect Authoriz -
CVE-2026-95605
WordPress WP Data Access plugin <= 5.5.82 - SQL Injection vu -
CVE-2026-93621
WordPress WP Data Access plugin <= 5.5.84 - SQL Injection vu -
CVE-2026-81293
WordPress WP Data Access plugin <= 5.5.81 - SQL Injection vu -
CVE-2026-66595
WordPress WP Data Access plugin <= 5.5.80 - Broken Access Co
Same vendor: Unknown
-
CVE-2026-110191
Product Delivery Date for WooCommerce – Lite < 3.3.2 - Contr -
CVE-2026-110015
Salon Booking System < 10.31.9 - Administrator Account Creat -
CVE-2026-110014
Salon Booking System < 10.31.9 - Unauthenticated Booking Cre -
CVE-2026-110179
affiliate-toolkit < 3.8.9 - Editor+ SQL Injection via orderb -
CVE-2026-110135
OTP Login & Register Woocommerce < 2.7.3 - Unauthenticated A
V. Comments for CVE-2026-106099
No comments yet