Privilege Escalation Vulnerability in WP Data Access Plugin for WordPress

CVE-2026-118267

What is CVE-2026-118267?

The WP Data Access plugin for WordPress contains a severe vulnerability that allows authenticated users, including those with Subscriber-level access, to exploit write endpoints without proper authorization checks. This oversight enables attackers to manipulate database records, including sensitive fields such as the WordPress administrator's password, potentially leading to complete site takeover. Exploitation can occur if an administrator publishes a Data App that supports write transactions for lower access levels, highlighting significant security implications for sites utilizing this plugin. To mitigate risks, a review of plugin configurations and an upgrade to the latest version are recommended.

References