SQL Injection Vulnerability in WP Data Access by Passionate Programmer Peter
CVE-2026-125832

8.5HIGH

Key Information:

Vendor

WordPress
Status
WP Data Access
Vendor
CVE Published:
15 November 2026

What is CVE-2026-125832?

An SQL Injection vulnerability in the WP Data Access plugin allows attackers to manipulate database queries due to improper neutralization of special elements in SQL commands. This weakness affects versions up to 5.5.92, posing significant risks to database integrity and security. Site administrators are advised to update to the latest version to mitigate potential exploitation of this issue.

Affected Version(s)

WP Data Access 0 <= 5.5.92

References

https://patchstack.com/database/wordpress/plugin/wp-data-...
vdb-entry

CVSS V3.1

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

AndrewN | Patchstack Bug Bounty Program
.