WP Data Access, CVE-2026-106098

CVE, Research URL: CVE-2026-106098
Home page URL: Security reports for WP Data Access
Application: WP Data Access
Published on: Oct 14, 2026
Research Description: The WP Data Access WordPress plugin before 5.5.77 does not correctly check authorization on one of its application REST endpoints, verifying only read permission before performing a write, which allows unauthenticated attackers to modify data in an application exposed for anonymous read access even when update actions have been disabled by the administrator.
Affected versions: max 5.5.77.
Status: vulnerable