CVE-2026-106099: WP Data Access < 5.5.84 - Unauthenticated Sensitive Data Disclosure via Table Export
The WP Data Access WordPress plugin before 5.5.84 does not restrict its database table export action to authorized users, gating it only with a token that the WP Data Access WordPress plugin before 5.5.84 itself prints into the public pages on which it displays a table, allowing unauthenticated attackers to export the complete contents of any publicly displayed table, including columns and rows withheld from the display shown to visitors.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WP Data Accessto a version that resolves this vulnerability.Fixed in 5.5.84
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated visitor who can access a public page where the plugin displays a database table may obtain the token needed for the export action. No authenticated WordPress account is required.
What data may be exposed?
An attacker can export the complete contents of a publicly displayed table, including columns and rows that are not shown to visitors in the table display.
Are all installations affected by default?
Exposure requires the plugin to display a database table on a public page. The available data does not establish that sites without publicly displayed tables are exploitable.
What is the immediate mitigation if updating is not possible?
Remove or restrict public access to pages that display WP Data Access tables, since those pages expose the token used to gate exports. Ensure sensitive tables are not publicly displayed.