CVE-2026-106098

Deferred Deferred - Pending Action

WP Data Access Plugin Authorization Bypass Vulnerability

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: WPScan

Description

The WP Data Access WordPress plugin before 5.5.77 does not correctly check authorization on one of its application REST endpoints, verifying only read permission before performing a write, which allows unauthenticated attackers to modify data in an application exposed for anonymous read access even when update actions have been disabled by the administrator.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106098

EUVD

EUVD-2026-100881

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	WP	Data Access 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

The WP Data Access WordPress plugin before version 5.5.77 has an authorization flaw in one of its REST endpoints. It only checks for read permissions before allowing write operations, enabling unauthenticated attackers to modify data in applications configured for anonymous read access, even when updates were disabled by the administrator.

Detection Guidance

Check if your WP Data Access plugin version is below 5.5.77. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files for version details. Monitor network traffic for unauthorized write attempts to REST endpoints.

Impact Analysis

This vulnerability allows attackers to alter data in your WordPress application without authentication. If your site uses the WP Data Access plugin and permits anonymous reads, sensitive information could be modified, leading to data corruption or unauthorized changes.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by allowing unauthorized data modification. GDPR requires strict access controls to prevent unauthorized changes to personal data, while HIPAA mandates protection against unauthorized data alteration. The flaw enables attackers to modify data even when updates are disabled, risking data integrity and confidentiality.

Mitigation Strategies

Update the WP Data Access plugin to version 5.5.77 or later immediately. Disable anonymous read access if updates are not possible. Review and restrict permissions for all REST endpoints.

Hi! I’m here to help you understand CVE-2026-106098. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70