CVE-2026-3235: WP Data Access – No-Code App Builder with Tables, Forms, Charts & Maps <= 5.5.68 - Unauthenticated Insecure Direct Object Reference to Data Access
The WP Data Access plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.5.68 via the 'checkappaccess' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to access data from protected app containers by exploiting a mismatch between the authorization check (performed against appid) and data retrieval (performed using cntid without verifying container ownership).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress WP Data Access pluginto a version that resolves this vulnerability.Fixed in 5.5.68
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can exploit it; no WordPress account or user interaction is required. The attacker must be able to submit a user-controlled key that causes the authorization check to use an app_id while data retrieval uses a cnt_id.
What information could be exposed?
The issue can expose data from protected app containers. The provided impact data indicates confidentiality impact only, with no stated integrity or availability impact.
Which installations are affected?
WP Data Access plugin versions up to and including 5.5.68 are affected. The vulnerability is in the plugin's check_app_access function and results from not verifying that the retrieved container belongs to the authorized app.
How can I determine whether data may have been exposed?
Review access and application logs for unauthenticated requests involving app access checks or container identifiers, especially requests where the app_id used for authorization differs from the cnt_id used to retrieve data. The provided information does not identify specific request paths, parameter names, or log signatures.