Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-118267— WP Data Access <= 5.5.89 - Incorrect Authorization to Unauthenticated Privilege Escalation via 'key' and 'val' Parameters on app/update, app/delete, app/insert

Quick assessment

Affected
peterschulznl WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 插件"WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps"存在授权不当漏洞，可能导致权限提升，影响范围涵盖 5.5.89 及之前的所有版本。该漏洞的成因在于：插件的写入端点（ 、 、 ）将攻击者提供的 和 参数直接传递给 、 和 ，而未对容器行级过滤器（ ）或列级白名单（ ）施加限制；而这些限制在读取端点中是正确实施的。 因此，拥有订阅者（Subscriber）及以上权限的已认证攻击者可以绕过配置的限

CVSS 8.1 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-118267

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
WP Data Access <= 5.5.89 - Incorrect Authorization to Unauthenticated Privilege Escalation via 'key' and 'val' Parameters on app/update, app/delete, app/insert
Source: CVE Program / CVE List V5
Vulnerability Description
The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to Incorrect Authorization leading to Privilege Escalation in all versions up to, and including, 5.5.89 This is due to the plugin's write endpoints (`wpda/app/update`, `wpda/app/delete`, `wpda/app/insert`) passing the attacker-supplied `key` and `val` parameters directly to `$wpdadb->update`, `$wpdadb->delete`, and `$wpdadb->insert` without enforcing the container's row-filter (`defaultWhere`) or per-column allow-list (`isSelected`) restrictions that are correctly applied on the read endpoints. This makes it possible for authenticated attackers, with Subscriber-level access and above, to write to arbitrary rows and columns outside the configured restrictions — including overwriting the `user_pass` field of the WordPress administrator account in `wp_users` — and subsequently authenticate as the administrator, achieving full site takeover. Exploitation requires an administrator to have published a Data App that enables write transactions (update, delete, or insert) for Subscriber-level or anonymous users, which is an explicitly advertised use-case of the plugin. Exploitation by unauthenticated attackers requires that the administrator has published a Data App whose rest_api.authorization is 'anonymous' and whose container has transactions.update (or delete/insert) enabled. On a default installation, where that is not configured, the vulnerability requires attackers with subscriber-level access and above.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
peterschulznl WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps 0 ~ 5.5.89 -

II. Public POCs for CVE-2026-118267

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-118267

请登录查看更多情报信息。

Other References for CVE-2026-118267 (7)

Same Patch Batch · peterschulznl · 2026-11-07 · 5 CVEs total

CVE-2026-118048 6.4 MEDIUM WP Data Access <= 5.5.89 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Aut
CVE-2026-118204 6.4 MEDIUM WP Data Access <= 5.5.89 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'Im
CVE-2026-120479 6.4 MEDIUM WP Data Access <= 5.5.90 - Authenticated (Subscriber+) Stored Cross-Site Scripting via TEX
CVE-2026-121536 5.3 MEDIUM WP Data Access <= 5.5.90 - Authenticated (Subscriber+) SQL Injection via 'engine' Paramete

IV. Related Vulnerabilities

Same product: WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps
Same vendor: peterschulznl
Same weakness: CWE-863