Unknown Wp Data Access vulnerabilities

4 CVEs affecting Unknown Wp Data Access, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-106470, published 2026-10-17.

More from Unknown.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-18032, published 2026-08-09. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. The WP Data Access WordPress plugin before 5.5.79 does not validate the column names it accepts on one of its unauthenticated AJAX actions, and the nonce guarding that action does not cover them,…
• CVE-2026-106099, published 2026-10-14. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. The WP Data Access WordPress plugin before 5.5.84 does not restrict its database table export action to authorized users, gating it only with a token that the WP Data Access WordPress plugin before…
• CVE-2026-106098, published 2026-10-14. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. The WP Data Access WordPress plugin before 5.5.77 does not correctly check authorization on one of its application REST endpoints, verifying only read permission before performing a write, which…
• CVE-2026-106470, published 2026-10-17. EPSS: 0.1% chance of exploitation in the next 30 days. The WP Data Access WordPress plugin before 5.5.88 does not have authorisation and CSRF checks in one of its actions, allowing any authenticated user, such as a subscriber, to make the server open…