CVE-2026-1182678.1HighCWE-863

CVE-2026-118267: WP Data Access <= 5.5.89 - Incorrect Authorization to Unauthenticated Privilege Escalation via 'key' and 'val' Parameters on app/update, app/delete, app/insert

peterschulznl · WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps

Affected: peterschulznl WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps · Exploitation: check available, not yet exploited

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

1.6%probability of exploitation in the next 30 days

76th percentile

050100

Higher than 76% of scored CVEs

8.1HighCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to Incorrect Authorization leading to Privilege Escalation in all versions up to, and including, 5.5.89 This is due to the plugin's write endpoints (`wpda/app/update`, `wpda/app/delete`, `wpda/app/insert`) passing the attacker-supplied `key` and `val` parameters directly to `$wpdadb->update`, `$wpdadb->delete`, and `$wpdadb->insert` without enforcing the container's row-filter (`defaultWhere`) or per-column allow-list (`isSelected`) restrictions that are correctly applied on the read endpoints. This makes it possible for authenticated attackers, with Subscriber-level access and above, to write to arbitrary rows and columns outside the configured restrictions — including overwriting the `user_pass` field of the WordPress administrator account in `wp_users` — and subsequently authenticate as the administrator, achieving full site takeover. Exploitation requires an administrator to have published a Data App that enables write transactions (update, delete, or insert) for Subscriber-level or anonymous users, which is an explicitly advertised use-case of the plugin. Exploitation by unauthenticated attackers requires that the administrator has published a Data App whose rest_api.authorization is 'anonymous' and whose container has transactions.update (or delete/insert) enabled. On a default installation, where that is not configured, the vulnerability requires attackers with subscriber-level access and above.

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

peterschulznl · WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Mapsup to and including 5.5.89

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Check available, not yet exploited. A public nuclei template can confirm it on a system you are authorised to test.
CISA KEV: Not listed
Public check: WP Data Access <= 5.5.89 - Incorrect Authorization to Privilege Escalation · nuclei template in projectdiscovery/nuclei-templates
Weakness: Incorrect Authorization · Access Control
Vendor: peterschulznl
Published: November 2026
Band: Check available, not yet exploited, November 2026

CoverageNo articles yet

No CyberSIXT article names CVE-2026-118267 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.