CVE-2026-110023
Received Received - Intake

Sensitive Information Exposure in WP Data Access WordPress Plugin

Publication date: 2026-10-31

Last updated on: 2026-10-31

Assigner: Wordfence

Description
The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.5.88 via the 'rel_tab' parameter. This makes it possible for unauthenticated attackers to extract every row and column of the underlying database table backing any anonymously published app, including WordPress user password hashes, email addresses, and password-reset keys from wp_users. Exploitation requires that an administrator has published at least one app with its REST API authorization set to 'anonymous', which is the standard configuration for publicly embedded apps.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-31
Last Modified
2026-10-31
Generated
2026-10-31
AI Q&A
2026-10-31
EPSS Evaluated
N/A
NVD
CVE-2026-110023
EUVD
EUVD-2026-114647

Affected Vendors & Products

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the WP Data Access plugin allows unauthenticated attackers to access sensitive database information through the 'rel_tab' parameter. It exposes all rows and columns of database tables used by anonymously published apps, including WordPress user passwords, email addresses, and password reset keys.

Detection Guidance

Check if any WordPress sites use the WP Data Access plugin version 5.5.88 or lower. Inspect network traffic for requests to the 'rel_tab' parameter in published apps with anonymous REST API access. Look for unusual database query patterns or exposed user data.

Impact Analysis

If you use this plugin with an app published anonymously, attackers could steal user credentials, personal data, and password reset tokens. This could lead to account takeovers, data breaches, or further attacks on your WordPress site or users.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access to personal data and HIPAA if health-related data is exposed. It results in non-compliance with data protection requirements, potentially leading to legal penalties and reputational damage.

Mitigation Strategies

Update the WP Data Access plugin to the latest version immediately. Disable anonymous REST API access for published apps. Review and restrict database access permissions. Monitor for unauthorized data exposure or suspicious queries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110023. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart