WP Data Access front-end form action permits arbitrary database-column reads
WP Data Access before 5.5.79 accepts attacker-selected column names through an unauthenticated AJAX action used by an affected front-end form. The action's nonce does not cover those column names, so an unauthenticated attacker can read arbitrary columns from the table bound to the form. If the form is bound to the WordPress users table, the exposed data can include password hashes.
- Component
- WP Data Access
- Plugin slug
wp-data-access- Affected
- < 5.5.79
- Safe version
5.5.79- Published
- Aug 09, 2026
This CVE was published Aug 09, 2026 and is one of 12 known issues for this plugin.
Update, patch or deactivate.
Update to 5.5.79 or later. Review front-end forms and access logs for unexpected column requests, force password resets if user hashes may have been exposed, and rotate other secrets stored in affected tables.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The WP Data Access WordPress plugin before 5.5.79 does not validate the column names it accepts on one of its unauthenticated AJAX actions, and the nonce guarding that action does not cover them, allowing unauthenticated attackers to read arbitrary columns of the database table the affected front-end form is bound to, including user password hashes where that table is the users table.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N