{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-118267", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-10-27T20:15:02.961Z", "datePublished": "2026-11-07T11:26:32.742Z", "dateUpdated": "2026-11-07T18:26:30.900Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-11-07T11:26:32.742Z"}, "affected": [{"vendor": "peterschulznl", "product": "WP Data Access \u2013 App Builder for Tables, Forms, Dashboards, Charts & Maps", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "5.5.89", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WP Data Access \u2013 App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to Incorrect Authorization leading to Privilege Escalation in all versions up to, and including, 5.5.89 This is due to the plugin's write endpoints (`wpda/app/update`, `wpda/app/delete`, `wpda/app/insert`) passing the attacker-supplied `key` and `val` parameters directly to `$wpdadb->update`, `$wpdadb->delete`, and `$wpdadb->insert` without enforcing the container's row-filter (`defaultWhere`) or per-column allow-list (`isSelected`) restrictions that are correctly applied on the read endpoints. This makes it possible for authenticated attackers, with Subscriber-level access and above, to write to arbitrary rows and columns outside the configured restrictions \u2014 including overwriting the `user_pass` field of the WordPress administrator account in `wp_users` \u2014 and subsequently authenticate as the administrator, achieving full site takeover. Exploitation requires an administrator to have published a Data App that enables write transactions (update, delete, or insert) for Subscriber-level or anonymous users, which is an explicitly advertised use-case of the plugin. Exploitation by unauthenticated attackers requires that the administrator has published a Data App whose rest_api.authorization is 'anonymous' and whose container has transactions.update (or delete/insert) enabled. On a default installation, where that is not configured, the vulnerability requires attackers with subscriber-level access and above."}], "title": "WP Data Access <= 5.5.89 - Incorrect Authorization to Unauthenticated Privilege Escalation via 'key' and 'val' Parameters on app/update, app/delete, app/insert", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a81029fe-db29-4dd4-8450-65d1764855f1?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.89/WPDataAccess/API/WPDA_Apps.php#L1213"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.89/WPDataAccess/API/WPDA_Apps.php#L1267"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.89/WPDataAccess/API/WPDA_Apps.php#L1186"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.89/WPDataAccess/API/WPDA_Table.php#L665"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.89/WPDataAccess/API/WPDA_Apps.php#L382"}, {"url": "https://plugins.trac.wordpress.org/changeset?reponame=&new=3771310%40wp-data-access%2Ftags%2F5.5.90&old=3761178%40wp-data-access%2Ftags%2F5.5.89"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-863 Incorrect Authorization", "cweId": "CWE-863", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Kuba"}], "timeline": [{"time": "2026-10-27T20:29:35.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-11-06T21:37:24.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-118267", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-07T18:11:38.819789Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-07T18:26:30.900Z"}}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WP Data Access \u2013 App Builder for Tables, Forms, Dashboards, Charts & Maps", "vendor": "peterschulznl", "versions": [{"lessThanOrEqual": "5.5.89", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WP Data Access \u2013 App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to Incorrect Authorization leading to Privilege Escalation in all versions up to, and including, 5.5.89 This is due to the plugin's write endpoints (`wpda/app/update`, `wpda/app/delete`, `wpda/app/insert`) passing the attacker-supplied `key` and `val` parameters directly to `$wpdadb->update`, `$wpdadb->delete`, and `$wpdadb->insert` without enforcing the container's row-filter (`defaultWhere`) or per-column allow-list (`isSelected`) restrictions that are correctly applied on the read endpoints. This makes it possible for authenticated attackers, with Subscriber-level access and above, to write to arbitrary rows and columns outside the configured restrictions \u2014 including overwriting the `user_pass` field of the WordPress administrator account in `wp_users` \u2014 and subsequently authenticate as the administrator, achieving full site takeover. Exploitation requires an administrator to have published a Data App that enables write transactions (update, delete, or insert) for Subscriber-level or anonymous users, which is an explicitly advertised use-case of the plugin. Exploitation by unauthenticated attackers requires that the administrator has published a Data App whose rest_api.authorization is 'anonymous' and whose container has transactions.update (or delete/insert) enabled. On a default installation, where that is not configured, the vulnerability requires attackers with subscriber-level access and above."}], "id": "CVE-2026-118267", "lastModified": "2026-11-07T19:17:18.410", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-118267", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-07T18:11:38.819789Z", "version": "2.0.3"}}]}, "published": "2026-11-07T12:17:43.867", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.89/WPDataAccess/API/WPDA_Apps.php#L1186"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.89/WPDataAccess/API/WPDA_Apps.php#L1213"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.89/WPDataAccess/API/WPDA_Apps.php#L1267"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.89/WPDataAccess/API/WPDA_Apps.php#L382"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.89/WPDataAccess/API/WPDA_Table.php#L665"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?reponame=&new=3771310%40wp-data-access%2Ftags%2F5.5.90&old=3761178%40wp-data-access%2Ftags%2F5.5.89"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a81029fe-db29-4dd4-8450-65d1764855f1?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"created": "2026-11-07T12:30:17.905676+00:00", "updated": "2026-11-07T12:30:17.905681+00:00", "vendors": []}