Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-18032— WP Data Access < 5.5.79 - Unauthenticated Sensitive Data Disclosure via Autocomplete Column Authorization Bypass

Quick assessment

Affected
Unknown WP Data Access
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress WP Data Access是WordPress基金会的一款内容管理系统的数据管理插件。 WordPress WP Data Access 5.5.79之前版本存在信息泄露漏洞，该漏洞源于未验证其接受的列名且nonce未覆盖该操作，可能导致未经身份验证的攻击者读取数据库表的任意列，包括用户密码哈希。

AI Predicted 8.9 Difficulty: Easy EPSS 0.43% · P35

Possible ATT&CK Techniques 1 AI

T1005 · Data from Local System

Affected Version Matrix 1

VendorProduct Version RangeStatus
Unknown WP Data Access < 5.5.79 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-18032

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
WP Data Access < 5.5.79 - Unauthenticated Sensitive Data Disclosure via Autocomplete Column Authorization Bypass
Source: CVE Program / CVE List V5
Vulnerability Description
The WP Data Access WordPress plugin before 5.5.79 does not validate the column names it accepts on one of its unauthenticated AJAX actions, and the nonce guarding that action does not cover them, allowing unauthenticated attackers to read arbitrary columns of the database table the affected front-end form is bound to, including user password hashes where that table is the users table.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress WP Data Access 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress WP Data Access是WordPress基金会的一款内容管理系统的数据管理插件。 WordPress WP Data Access 5.5.79之前版本存在信息泄露漏洞，该漏洞源于未验证其接受的列名且nonce未覆盖该操作，可能导致未经身份验证的攻击者读取数据库表的任意列，包括用户密码哈希。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Unknown WP Data Access 0 ~ 5.5.79 -

II. Public POCs for CVE-2026-18032

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-18032

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-18032 (1)

Same Patch Batch · Unknown · 2026-08-09 · 17 CVEs total

CVE-2026-15038 InfiniteWP Client < 1.13.6 - Unauthenticated Administrator Account Takeover on Multisite
CVE-2026-16032 LWS Optimize < 4.1.2 - Unauthenticated Stored XSS via Real User Monitoring
CVE-2026-18473 WP Directory Kit < 1.5.5 - Unauthenticated SQL Injection via 'field_search' Parameter
CVE-2026-18603 Cancel Order & Request Woocommerce < 1.3.4.34 - Unauthenticated Order Content Disclosure v
CVE-2026-18465 WP Maps Pro < 6.1.3 - Unauthenticated Local File Inclusion
CVE-2026-17017 CubeWP Framework < 1.1.31 - Subscriber+ SQL Injection via cubewp_remove_relation
CVE-2026-18357 WPC Order Tip for WooCommerce < 3.3.1 - Unauthenticated Order Data Disclosure
CVE-2026-18464 WP Maps Pro < 6.1.3 - Unauthenticated Denial of Service
CVE-2026-18037 Create by Mediavine < 2.5.4 - Unauthenticated Unpublished Content Disclosure and Publicati
CVE-2026-17044 WordPress File Upload < 5.1.8 - Unauthenticated SQL Injection via uniqueuploadid
CVE-2026-17014 WP Photo Album Plus < 9.2.07.002 - Unauthenticated Export ZIP File Deletion via delexportz
CVE-2026-16965 Solace Extra < 1.6.1 - Subscriber+ Post Meta Update via solace_update_sitebuilder_status
CVE-2026-16988 GeoDirectory < 2.8.169 - Unauthenticated Pending/Draft Listing Disclosure via markers REST
CVE-2026-16992 Create by Mediavine < 2.5.4 - Unauthenticated Unpublished Content Disclosure and Publicati
CVE-2026-16957 Slim SEO < 4.9.11 - Contributor+ Arbitrary Post Meta Disclosure
CVE-2026-17011 Nexter Blocks < 5.0.2 - Contributor+ Stored CSS Injection

IV. Related Vulnerabilities

Same product: WP Data Access
Same vendor: Unknown

V. Comments for CVE-2026-18032

No comments yet

Leave a comment