WordPress Plugin Vulnerabilities

WP Data Access < 5.5.77 - Unauthenticated Incorrect Authorization via Inline App Update

Description

The plugin does not correctly check authorization on one of its application REST endpoints, verifying only read permission before performing a write, which allows unauthenticated attackers to modify data in an application exposed for anonymous read access even when update actions have been disabled by the administrator.

Proof of Concept

Affects Plugins

Plugin icon
wp-data-access
Fixed in 5.5.77

References

CVE
CVE-2026-106098

Classification

Type
INCORRECT AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-863
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Muni Nitish Kumar Yaddala
Submitter
Muni Nitish Kumar Yaddala
Verified
Yes
WPVDB ID
f062a098-c00c-49f8-a32a-58b18ebcebe2

Timeline

Publicly Published
2026-10-12 (about 2 days ago)
Added
2026-10-12 (about 1 day ago)
Last Updated
2026-10-12 (about 1 day ago)

Other

Published
Title
Published
2026-08-27
Title
Amelia 1.2.32 - 2.4.8 - Amelia Customer+ Appointment Status Update and Self-Approval
Published
2025-07-30
Title
HT Mega – Absolute Addons For Elementor < 2.9.2 - Improper Authorization to Authenticated (Contributor+) Limited Administrator Actions
Published
2024-07-16
Title
BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin < 1.1.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update and Arbitrary File Upload
Published
2026-02-25
Title
The Events Calendar < 6.15.16.1 - Contributor+ Event/Organizer/Venue Update/Trash via REST API
Published
2022-11-16
Title
SVG Support 2.5-2.5.1 - Author+ Stored XSS