CVE-2026-3235

Deferred Deferred - Pending Action

Insecure Direct Object Reference in WP Data Access Plugin

Publication date: 2026-08-26

Last updated on: 2026-08-28

Assigner: Wordfence

Description

The WP Data Access plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.5.68 via the 'check_app_access' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to access data from protected app containers by exploiting a mismatch between the authorization check (performed against app_id) and data retrieval (performed using cnt_id without verifying container ownership).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-08-28

Generated

2026-09-15

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-14

NVD

CVE-2026-3235

EUVD

EUVD-2026-66407

Affected Vendors & Products

Vendor	Product	Version / Range
wp_data_access	wp_data_access	to 5.5.68 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

The WP Data Access plugin for WordPress has an Insecure Direct Object Reference vulnerability in versions up to 5.5.68. The flaw is in the 'check_app_access' function, which lacks validation on a user-controlled key. This allows unauthenticated attackers to access data from protected app containers by exploiting a mismatch between authorization checks and data retrieval.

Detection Guidance

To detect this vulnerability, check if the WP Data Access plugin version is up to 5.5.68 or lower. Look for unauthorized access attempts to protected app containers via the 'check_app_access' function. Monitor logs for requests targeting the vulnerable endpoint without proper authentication.

Impact Analysis

Unauthenticated attackers could access sensitive data stored in protected app containers. This may lead to unauthorized data exposure, potential data leaks, or privacy violations depending on the nature of the data stored in the plugin.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA compliance requirements. It may result in data breaches, triggering mandatory breach notifications and potential fines under these regulations.

Mitigation Strategies

Update the WP Data Access plugin to the latest version beyond 5.5.68 to address the insecure direct object reference vulnerability. If an update is not available, consider disabling the plugin temporarily until a patch is released.

Hi! I’m here to help you understand CVE-2026-3235. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70