WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards <= 5.5.83 - Authenticated (Contributor+) Missing Authorization to Database Table Access via wpdadiehard Shortcode
- ID
- WPSEC-2026-0206
- Plugin
- WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards (wp-data-access)
- Affected
- all versions before 5.5.84
- Remediation
- Update to 5.5.84 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards on WPSec AttackSurface
- Fix released
- Published
Description
The WP Data Access plugin for WordPress is vulnerable to unauthorized data access and modification via the 'wpdadiehard' shortcode in all versions up to, and including, 5.5.83. The shortcode accepted user-supplied 'table_name' and 'schema_name' attributes together with 'allow_insert', 'allow_update', 'allow_delete' and 'allow_import' attributes, and it rendered Data Project pages without checking the roles assigned to the page unless the 'use roles in shortcode' option was enabled, which it is not by default. This makes it possible for authenticated attackers, with Contributor-level access and above, to embed the shortcode in a post to display, and optionally allow inserting, editing and deleting rows in, database tables that the administrator made available to the front end, or any Data Project page regardless of its role restrictions. This access extends to anyone who views the post, including unauthenticated visitors. Viewers also receive the table's export token, which allows them to export the entire table without the page's row filters.
References
- https://wpsec.com/vuln/WPSEC-2026-0206/
- https://plugins.svn.wordpress.org/wp-data-access/tags/5.5.84/
- https://wordpress.org/plugins/wp-data-access/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS