S4E just found a high-severity finding from top 10 tcp port service scan
PlatformPlansPartners
Resources
ToolsBlogDocs
Labs
CVE ForecastOpservantAll Research →
Sign Up →
high·Product Based Web Vulnerabilities·Updated Nov 9, 2026

CVE-2026-118267 Scanner

CVE-2026-118267 Scanner - Privilege Escalation vulnerability in WP Data Access

Est. Time~10 seconds
Scan TypeSingle Scan
Targetsdomain, subdomain, ipv4
CostFree
3
Times Used
continuous scan runs
3.4k
Continuously Checked
assets under CS
0
Vulnerabilities Found
confirmed findings
References
8.1
CVSShigh
Exploitable remotely over the internet · no authentication required.
Description

The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to Incorrect Authorization leading to Privilege Escalation in all versions up to, and including, 5.5.89 This is due to the plugin's write endpoints (`wpda/app/update`, `wpda/app/delete`, `wpda/app/insert`) passing the attacker-supplied `key` and `val` parameters directly to `$wpdadb->update`, `$wpdadb->delete`, and `$wpdadb->insert` without enforcing the container's row-filter (`defaultWhere`) or per-column allow-list (`isSelected`) restrictions that are correctly applied on the read endpoints. This makes it possible for authenticated attackers, with Subscriber-level access and above, to write to arbitrary rows and columns outside the configured restrictions — including overwriting the `user_pass` field of the WordPress administrator account in `wp_users` — and subsequently authenticate as the administrator, achieving full site takeover. Exploitation requires an administrator to have published a Data App that enables write transactions (update, delete, or insert) for Subscriber-level or anonymous users, which is an explicitly advertised use-case of the plugin. Exploitation by unauthenticated attackers requires that the administrator has published a Data App whose rest_api.authorization is 'anonymous' and whose container has transactions.update (or delete/insert) enabled. On a default installation, where that is not configured, the vulnerability requires attackers with subscriber-level access and above.

Attack Vector
Network
Privileges Req.
None
User Interaction
None
Affected
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Mapsby peterschulznl
0
Updated Nov 9, 2026View on NVD →
Detail

WP Data Access is a popular plugin used by WordPress users to build data-driven applications within their websites. The plugin allows administrators and developers to create and interact with databases using advanced query options and is used by web developers, businesses, and organizations for data management and manipulation on WordPress sites. The software simplifies complex tasks, such as creating dashboards and reports, and is integral for those requiring extensive data operations via the WordPress platform. WP Data Access is favored for its versatility and ability to handle large datasets with ease. Its integration into the WordPress ecosystem allows users to manage data without needing extensive development experience.

Privilege escalation vulnerabilities occur when unauthorized users gain elevated access to resources that are normally protected from them. This specific vulnerability in WP Data Access affects the REST API endpoints, along with the absence of necessary restrictions. The vulnerability allows attackers to execute unauthorized database operations, thereby manipulating database contents and elevating privileges. This improper authorization can lead to severe security breaches, including administrative control acquisition. Attackers exploit insufficient enforcement of the app's security policies, such as default row filters, in write transactions.

This vulnerability involves the direct manipulation of REST API endpoints in the plugin without authorization checks. Attackers can use parameters supplied via the API to perform database operations that should be restricted or controlled. Specifically, unauthorized users can bypass normal validations because essential security checks like 'defaultWhere' or 'isSelected' are not enforced on write endpoints. This oversight exposes endpoint functionality that permits manipulation of data including critical fields like admin passwords. A successful exploitation allows unauthorized modifications to database rows and fields by attackers.

If exploited, this vulnerability can allow attackers to take over a WordPress site completely. By leveraging incorrect authorization settings within the plugin, attackers could potentially change administrator passwords, log in as site administrators, and gain full access to sensitive data and functionalities. This may result in data theft, site defacement, deployment of malicious code, or further exploitation of connected networks. The consequence is a significant compromise in site integrity, data confidentiality, and user trust.

REFERENCES

Solution Advice
  • Update the WP Data Access plugin to version 5.5.90 or later to ensure that security measures such as 'defaultWhere' and 'isSelected' restrictions are enforced on write endpoints.
  • Regularly audit permissions and API configurations to avoid unauthorized access points.
  • Implement additional security layers such as web application firewalls (WAF) to monitor and block exploit attempts.
  • Review and modify any admin settings for REST API access that may inadvertently allow anonymous capability enhancement.

Get AI-powered remediation steps tailored to your asset.

Try AI Solutions →
Similar Tools
critical
CVE-2025-69971 Scanner
→critical
CVE-2026-1830 Scanner
→medium
CVE-2026-3335 Scanner
→high
CVE-2025-64500 Scanner
→high
CVE-2026-10768 Scanner
→high
CVE-2026-34453 Scanner
→critical
CVE-2025-67303 Scanner
→critical
CVE-2026-33032 Scanner
→

Check your infrastructure.
Right now.

11,000+ scanners. Free to start. No credit card required.