Unauthenticated Broken Access Control in WP Data Access by WordPress
CVE-2026-66595

5.9MEDIUM

Key Information:

Vendor

WordPress
Status
WP Data Access
Vendor
CVE Published:
20 August 2026

What is CVE-2026-66595?

The vulnerability identified in WP Data Access versions up to 5.5.80 allows unauthenticated users to exploit insufficient access controls. This flaw could enable attackers to access restricted areas of the application, potentially leading to data exposure or unauthorized actions. It is crucial for users of this plugin to implement updates and mitigate risks by reviewing their security settings.

Affected Version(s)

WP Data Access <= 5.5.80

References

https://patchstack.com/database/wordpress/plugin/wp-data-...
vdb-entry

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

doc4cash | Patchstack Bug Bounty Program
.