Wp Data Access (Unknown) - vulnerabilities (CVEs)

5 CVEs, 3 in the last 30 days, 1 known versions, newest CVE from 2026-10-17. Vendor: Unknown.

CVEs of Wp Data Access

• CVE-2026-106470 - CVSS 5 (medium), 2026-10-17: The WP Data Access WordPress plugin before 5.5.88 does not have authorisation and CSRF checks in one of its actions, allowing any authenticated user, such as…
• CVE-2026-106099 - CVSS 5.3 (medium), 2026-10-14: The WP Data Access WordPress plugin before 5.5.84 does not restrict its database table export action to authorized users, gating it only with a token that the…
• CVE-2026-106098 - CVSS 5.3 (medium), 2026-10-14: The WP Data Access WordPress plugin before 5.5.77 does not correctly check authorization on one of its application REST endpoints, verifying only read…
• CVE-2026-18032 - CVSS 7.5 (high), 2026-08-09: The WP Data Access WordPress plugin before 5.5.79 does not validate the column names it accepts on one of its unauthenticated AJAX actions, and the nonce…
• CVE-2021-24866 - CVSS 9.8 (critical), 2021-12-06: The WP Data Access WordPress plugin before 5.0.0 does not properly sanitise and escape the backup_date parameter before using it a SQL statement, leading to a…