CVE-2026-106098: WP Data Access < 5.5.77 - Unauthenticated Incorrect Authorization via Inline App Update

Q: Which deployments are exposed to unauthenticated modification?

Deployments using WP Data Access versions before 5.5.77 are exposed when an application is configured for anonymous read access. The issue can permit modification even if the administrator has disabled update actions.

Q: What access does an attacker need?

An attacker does not need to authenticate if they can reach an affected application's REST endpoint and that application permits anonymous reads. The vulnerable endpoint checks read permission but performs a write operation.

Published Oct 14, 2026

Updated

The WP Data Access WordPress plugin before 5.5.77 does not correctly check authorization on one of its application REST endpoints, verifying only read permission before performing a write, which allows unauthenticated attackers to modify data in an application exposed for anonymous read access even when update actions have been disabled by the administrator.

Affected Software

1 affected component

WP Data Access<5.5.77

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WP Data Access WordPress plugin to a version that resolves this vulnerability.
Fixed in 5.5.77

Event History

Oct 14, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed to unauthenticated modification?

Deployments using WP Data Access versions before 5.5.77 are exposed when an application is configured for anonymous read access. The issue can permit modification even if the administrator has disabled update actions.

What access does an attacker need?

An attacker does not need to authenticate if they can reach an affected application's REST endpoint and that application permits anonymous reads. The vulnerable endpoint checks read permission but performs a write operation.