CVE-2026-110023
Medium · 5.9CVSS
5.9
EPSS
0.3%
Published
Oct 31, 2026
CISA due date
—
The record
The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.5.88 via the 'rel_tab' parameter. This makes it possible for unauthenticated attackers to extract every row and column of the underlying database table backing any anonymously published app, including WordPress user password hashes, email addresses, and password-reset keys from wp_users. Exploitation requires that an administrator has published at least one app with its REST API authorization set to 'anonymous', which is the standard configuration for publicly embedded apps.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-121728 SourceHut meta.sr.ht 0.56.11 before 0.89.0 contains an authorization bypass vulnerability… CWE-862
- CVE-2026-121730 emailflare before commit cf31f33 contains a missing authorization vulnerability in POST… CWE-862
- CVE-2026-121729 emailflare before commit cf31f33 contains a missing authorization vulnerability in the… CWE-862
- CVE-2026-116663 Tanium addressed an improper access controls vulnerability in Enforce. CWE-862
- CVE-2026-121253 Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a… CWE-862
- CVE-2026-121251 Missing authorization in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote… CWE-862
- CVE-2026-121194 Missing authorization in SiteIsolation in Google Chrome prior to 157.0.8103.38 allowed a… CWE-862
- CVE-2026-121199 Missing authorization in Chromoting in Google Chrome on on Mac prior to 157.0.8103.38… CWE-862