WP Data Access Through 5.5.89 - Actively Exploited Privilege Escalation (CVE-2026-118267)

WP Data Access through 5.5.89 has an actively exploited authorization flaw that can enable administrator takeover in write-enabled Data Apps. Update to 5.5.90 or later.

WP Data Access versions through 5.5.89 are vulnerable to an authorization flaw that can let a low-privilege user overwrite data outside an App Builder container’s configured restrictions and, in exposed configurations, escalate to administrator access. Patchstack lists the issue as known to be exploited. Update to 5.5.90 or later; the current WordPress.org release is newer and should be preferred.

Table of Contents

Vulnerability summary

Plugin: WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps
Affected versions: 5.5.89 and earlier
Fixed version: 5.5.90
CVE: CVE-2026-118267
Class: Incorrect authorization / privilege escalation
Severity: CVSS 9.8 (Patchstack); CVSS 8.1 High (Wordfence)
Required access: Subscriber or higher by default; unauthenticated only when an administrator has published a Data App with anonymous REST authorization and write transactions enabled
Exploitation status: Listed by Patchstack as known to be exploited; this is Patchstack telemetry, not a CISA Known Exploited Vulnerabilities catalog designation

How the flaw can be exploited

According to Wordfence Intelligence, the App Builder write endpoints for update, delete, and insert operations accepted attacker-controlled key and value parameters without consistently enforcing the container’s row filter or selected-column restrictions. A user who could reach a write-enabled Data App could therefore target rows and columns beyond the administrator’s intended configuration.

The most serious documented impact is modification of an administrator record in the WordPress users table, including the password field, followed by administrator authentication and full site takeover. This does not mean every installation is anonymously exploitable: the practical prerequisite depends on how the Data App was published.

Exposure prerequisites

A vulnerable WP Data Access version is active.
An administrator has published a Data App with update, delete, or insert transactions enabled.
For the unauthenticated path, the app must allow anonymous REST authorization.
Without anonymous access, an attacker generally needs a Subscriber-level account or another role permitted to use the write-enabled app.

Immediate mitigation

Update WP Data Access to 5.5.90 or later immediately. WordPress.org records the authorization fix in 5.5.90 as enforcement of the default WHERE clause on transactions.
Prefer the latest available release rather than stopping at the first fixed version.
If an update cannot be completed immediately, deactivate WP Data Access or unpublish all Data Apps that permit write transactions.
Remove anonymous REST authorization and Subscriber access from data-management apps until the update and review are complete.
If exposure is suspected, reset administrator passwords, invalidate active sessions, rotate WordPress salts, and review privileged accounts before returning the app to service.

Verify the installed version

From the WordPress root, administrators can confirm the installed version and plugin state with WP-CLI:

wp plugin get wp-data-access --fields=name,status,version
wp plugin update wp-data-access
wp plugin get wp-data-access --fields=name,status,version

The final version must be 5.5.90 or newer. If the plugin is managed by deployment tooling, update the locked package or artifact as well so the vulnerable build is not restored later.

Compromise review

No universal file hash, IP address, or malware signature has been published for this vulnerability. Review the site for behavioral indicators instead:

Unexpected administrator accounts or recent role changes
Administrator password resets that were not initiated by the account owner
Successful logins from unfamiliar IP addresses shortly after requests to WP Data Access REST routes
Changes to Data App authorization, transaction, row-filter, or selected-column settings
New plugins, themes, scheduled tasks, or PHP files created after suspicious authentication activity

Useful read-only checks include:

wp user list --role=administrator --fields=ID,user_login,user_email,user_registered
wp cron event list --fields=hook,next_run_gmt,recurrence
wp plugin list --status=active --fields=name,status,version,update

Compare the output with an approved account and deployment inventory. Also search web-server and WAF logs for requests to WP Data Access App Builder REST endpoints, then correlate those requests with account logins and database changes.

Remediation checklist

Update to WP Data Access 5.5.90 or later.
Review every published Data App’s REST authorization and write-transaction settings.
Remove anonymous or low-privilege write access unless it is strictly required.
Inspect administrator accounts, password-reset events, active sessions, plugins, scheduled tasks, and recently modified PHP files.
Rotate credentials and salts when evidence suggests account takeover.
Keep application and access logs long enough to reconstruct activity around the disclosure and exploitation window.

WP Data Access Through 5.5.89 – Actively Exploited Privilege Escalation (CVE-2026-118267)