Vulnerability in WP Data Access Plugin Allows Unauthorized Database Access
CVE-2026-18032
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 9 August 2026
Badges
What is CVE-2026-18032?
The WP Data Access plugin for WordPress before version 5.5.79 contains a vulnerability where it fails to properly validate column names in an unauthenticated AJAX action. This oversight permits attackers to manipulate requests and gain unauthorized access to the database. Specifically, they could retrieve sensitive information, including user password hashes, when the exposed table is the users table. The vulnerability highlights the risks associated with inadequate input validation and the need for robust nonce protection to secure AJAX actions.
Affected Version(s)
WP Data Access 0 < 5.5.79
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.