[ CVE-2026-106098 · Published 14 Oct 2026 ]
Vulnerability in Unknown WP Data Access
CVSS 5.3
EPSS <1%No fix listed yet
[ Description ]Official description
The WP Data Access WordPress plugin before 5.5.77 does not correctly check authorization on one of its application REST endpoints, verifying only read permission before performing a write, which allows unauthenticated attackers to modify data in an application exposed for anonymous read access even when update actions have been disabled by the administrator.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.