Search
Search Results (4 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-106470 | 1 Wordpress-extensions | 1 Wp Data Access | 2026-10-17 | N/A |
| The WP Data Access WordPress plugin before 5.5.88 does not have authorisation and CSRF checks in one of its actions, allowing any authenticated user, such as a subscriber, to make the server open connections to arbitrary hosts and ports, including internal ones, and read back the outcome. | ||||
| CVE-2026-106098 | 1 Wordpress-extensions | 1 Wp Data Access | 2026-10-17 | 5.3 Medium |
| The WP Data Access WordPress plugin before 5.5.77 does not correctly check authorization on one of its application REST endpoints, verifying only read permission before performing a write, which allows unauthenticated attackers to modify data in an application exposed for anonymous read access even when update actions have been disabled by the administrator. | ||||
| CVE-2026-106099 | 1 Wordpress-extensions | 1 Wp Data Access | 2026-10-17 | 5.3 Medium |
| The WP Data Access WordPress plugin before 5.5.84 does not restrict its database table export action to authorized users, gating it only with a token that the WP Data Access WordPress plugin before 5.5.84 itself prints into the public pages on which it displays a table, allowing unauthenticated attackers to export the complete contents of any publicly displayed table, including columns and rows withheld from the display shown to visitors. | ||||
| CVE-2026-95605 | 2 Passionate Programmer Peter, Wordpress-extensions | 2 Wp Data Access, Wp Data Access | 2026-10-09 | 9.3 Critical |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Passionate Programmer Peter WP Data Access allows Blind SQL Injection. This issue affects WP Data Access: from n/a through 5.5.82. | ||||
Page 1 of 1.